Dashboard / CVE-2025-67325

CVE-2025-67325

CRITICAL 1 PoC
INFO Priority: 0.09 BB Relevance: 90/100
Published: 2026-01-08 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
webkul qloapps < 1.7.0

References & Advisories (2)

https://github.com/mr7s3d0/CVE-2025-67325
Exploit Third Party Advisory

Proof of Concept (1)

★ 1
https://github.com/mr7s3d0/CVE-2025-67325
nomi-sec

Bug Bounty Relevance

90 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.91%
Raw Score 0.009050
Percentile 60.0%
Date 2026-11-05

EPSS Trend

2026-11-05
0.00905
2026-11-04
0.00905

Intelligence Sources

nvd ref →

External Links