Reflected Cross-Site Scripting Vulnerability in QloApps by QloApps
CVE-2026-103589

5.1MEDIUM

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103589?

QloApps through version 1.7.0 is vulnerable to a reflected cross-site scripting (XSS) issue in the back-office room type editor. This flaw occurs due to improper escaping of user input fields including room_num, floor, and comment. Malicious actors can exploit this vulnerability by convincing logged-in administrative users to submit specially crafted POST requests. If successful, an attacker can execute arbitrary JavaScript code within the context of the victim's session, potentially leading to unauthorized access and data manipulation.

Affected Version(s)

QloApps 0 <= 1.7.0

References

https://github.com/Qloapps/QloApps/pull/1899
issue-trackingpatch
https://github.com/Qloapps/QloApps/commit/7ed467d911086b1...
patch
https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/them...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153
.