Reflected Cross-Site Scripting in QloApps by QloApps
CVE-2026-110219

5.1MEDIUM

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110219?

QloApps versions up to 1.7.0 are vulnerable to a reflected cross-site scripting issue. This vulnerability allows attackers to craft malicious scripts through the price parameter in the back-office Additional Facilities form. When an authenticated user submits a specially crafted request, the system may re-render the unescaped price value, executing the attacker’s JavaScript code within the administrator's session. This can lead to unauthorized access and compromise of sensitive administrative functionalities.

Affected Version(s)

QloApps 0 <= 1.7.0

References

https://hackmd.io/@leediay/SyMoELioMx
third-party-advisory
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/ho...
technical-description
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/ho...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.