Webkul

Webkul develops a modest but prominent portfolio of open-source e-commerce, CRM, and helpdesk platforms including Bagisto, Qloapps, Krayin CRM, UnoPim, and UVDesk, which serve small-to-medium businesses and are embedded across hosted and self-managed deployments. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and frequently acquire public exploit code. The exposure recurs consistently across the product line through web application weaknesses including cross-site scripting, CSRF, authorization bypasses, template injection, and code injection—patterns characteristic of PHP-based platforms with complex user input flows and access-control logic. These classes reflect the attack surface inherent to user-facing web applications where authentication, templating, and form handling are core features; defenders should treat Webkul platform updates as priority when instances are internet-reachable. Current exploitation activity and exposure counts are shown alongside this summary.