How many CVEs does Webkul have?

Webkul has 62 published CVE records since 2010, including 35 in the last two years.

How many Webkul CVEs are in CISA KEV?

None of Webkul's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Webkul products have the most CVEs?

The Webkul products with the most published CVEs are Bagisto, hotelcommerce, QloApps, krayin crm, unopim.

What are the most common weakness types in Webkul CVEs?

Webkul's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).

Are there public exploits for Webkul vulnerabilities?

Yes — 43 of Webkul's CVEs have a known public exploit.

How many critical Webkul vulnerabilities are there?

Webkul has 6 critical and 23 high-severity CVEs.

What is the average severity of Webkul CVEs?

The average CVSS base score across Webkul's scored CVEs is 7.0.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

62 CVEs

Webkul Vulnerabilities

Name: Webkul vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Webkul.

62

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

43

Public exploits

PoC or exploit code

7.0

Avg CVSS

2010–2026

Overview

Webkul has 62 published CVE records since 2010, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 43 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Webkul products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Webkul's vulnerability posture, as a share of its 62 published CVEs.

Average CVSS: 7.0
Critical / high: 48%
Actively exploited (KEV): 0%
Public exploit available: 69%
Patch available: 53%

Severity and exploitation

How the CVSS severity of Webkul's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High23

Medium31

Low1

1 additional CVE has no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Webkul's CVEs are currently listed in CISA's KEV catalog.

Public exploits

43

43 of Webkul's CVEs have a known public exploit available.

Most affected products

The Webkul products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Webkul CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Webkul CVE records.

Disclosure activity by year

How many Webkul CVEs were published each year.

2010

1

2019

2

2022

1

2023

9

2024

14

2025

20

2026

15

Latest Webkul CVEs

The most recently disclosed vulnerabilities affecting Webkul.

Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
CWE-79
Medium · CVSS 5.1
EPSS 0.2%2026-07-09
Joomla! Component Ajax Quiz 1.8 SQL Injection
CWE-89
High · CVSS 8.8
EPSS 0.4%2026-06-19
Path Traversal Vulnerability in Bagisto
CWE-22
High · CVSS 8.7
EPSS 0.5%2026-06-08
Bagisto Custom Scripts cross site scripting
CWE-94
Medium · CVSS 5.1
EPSS 0.2%2026-04-21
High vulnerability · 2026-04-14
CWE-269
High · CVSS 8.8
EPSS 0.6%2026-04-14
High vulnerability · 2026-04-14
CWE-639
High · CVSS 8.1
EPSS 0.4%2026-04-14
High vulnerability · 2026-04-14
CWE-639
High · CVSS 8.1
EPSS 0.4%2026-04-14
Vulnerability vulnerability · 2026-01-12
Unscored
EPSS 0.1%2026-01-12
Critical vulnerability · 2026-01-08
CWE-434
Critical · CVSS 9.8
EPSS 0.8%2026-01-08
Bagisto has SSTI in parameter that can lead to RCE
CWE-1336
High · CVSS 7.3
EPSS 1.2%2026-01-02
Bagisto has HTML Filter Bypass that Enables Stored XSS
CWE-79
Medium · CVSS 5.2
EPSS 0.5%2026-01-02
Bagisto has SSTI via first and last name from low-privilege user (not admin)
CWE-1336
High · CVSS 7.4
EPSS 0.5%2026-01-02

Track new Webkul CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Webkul CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft25,696 CVEs linux21,056 CVEs Google15,680 CVEs Apple14,957 CVEs Oracle11,815 CVEs Debian10,221 CVEs IBM8,381 CVEs Red Hat7,837 CVEs

Browse all vendors

Frequently asked questions

Common questions about Webkul vulnerabilities.

How many CVEs does Webkul have?: Webkul has 62 published CVE records since 2010, including 35 in the last two years.
How many Webkul CVEs are in CISA KEV?: None of Webkul's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Webkul products have the most CVEs?: The Webkul products with the most published CVEs are Bagisto, hotelcommerce, QloApps, krayin crm, unopim.
What are the most common weakness types in Webkul CVEs?: Webkul's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).
Are there public exploits for Webkul vulnerabilities?: Yes — 43 of Webkul's CVEs have a known public exploit.
How many critical Webkul vulnerabilities are there?: Webkul has 6 critical and 23 high-severity CVEs.
What is the average severity of Webkul CVEs?: The average CVSS base score across Webkul's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Webkul vulnerabilities

Monitor new Webkul vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing