CVE-2025-6173

A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release.

• CWE-74
• CWE-89
• CWE-89

• https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.mdExploit, Third Party Advisory
• https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md#vulnerability-recurrenceExploit, Third Party Advisory
• https://vuldb.com/?ctiid.312661Permissions Required, VDB Entry
• https://vuldb.com/?id.312661Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.593679Third Party Advisory, VDB Entry

Published

Jun 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61724The Reader.ReadResponse function constructs a response strin…5.3
• CVE-2025-61725The ParseAddress function constructs domain-literal address …7.5
• CVE-2025-61726The net/url package does not set a limit on the number of qu…7.5
• CVE-2025-61727An excluded subdomain constraint in a certificate chain does…6.5
• CVE-2025-61728archive/zip uses a super-linear file name indexing algorithm…6.5
• CVE-2025-61729Within HostnameError.Error(), when constructing an error str…7.5
• CVE-2025-61730During the TLS 1.3 handshake if multiple messages are sent i…5.3
• CVE-2025-61731Building a malicious file with cmd/go can cause can cause a …7.8
• CVE-2025-61732A discrepancy between how Go and C/C++ comments were parsed …8.6
• CVE-2025-61733Authentication Bypass Using an Alternate Path or Channel vul…7.5
• CVE-2025-61734Files or Directories Accessible to External Parties vulnerab…7.5
• CVE-2025-61735Server-Side Request Forgery (SSRF) vulnerability in Apache K…7.3