CVE-2021-41074
Medium · 5.4CVSS
5.4
EPSS
0.1%
Published
Jan 12, 2026
CISA due date
—
The record
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|