CVE-2025-10759 Webkul QloApps CSRF Token authorization
Attackers can bypass authorization via CSRF token manipulation in Webkul QloApps, requiring vendor patch for resolution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10759?
CVE-2025-10759 is a medium-severity vulnerability in Webkul QloApps, published on 21 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release."
Which versions are affected by CVE-2025-10759?
It affects 1 product.
Products include Webkul Qloapps.
How do I fix CVE-2025-10759?
No fix has been published for CVE-2025-10759 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-10759 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10759 exists.
Other vulnerabilities in Webkul QloApps
Sources
Also known as GHSA-m873-c52f-87pg.