Reflected Cross-Site Scripting Flaw in QloApps Hotel Reservation System
CVE-2026-103587

5.1MEDIUM

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103587?

QloApps version 1.7.0 features a reflected cross-site scripting vulnerability within the Hotel Reservation System's Book Now search functionality. The vulnerability arises when parameters such as date_to and id_room_type are processed without proper validation, allowing malicious users to insert JavaScript payloads. If an authenticated administrator clicks on a specially crafted link, the script executes in their session, potentially compromising sensitive information and system integrity.

Affected Version(s)

QloApps 0 <= 1.7.0

References

https://github.com/Qloapps/QloApps/pull/1884
issue-trackingpatch
https://github.com/Qloapps/QloApps/commit/1d06fd302a935d6...
patch
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/ho...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153
.