Reflected XSS Vulnerability in QloApps Admin Interface
CVE-2026-110224

5.1MEDIUM

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110224?

QloApps version 1.7.0 is susceptible to a reflected cross-site scripting flaw in the AdminSearchConfController::processSave() method. This vulnerability allows attackers to manipulate input values, leading to unescaped output in validation errors. By successfully tricking an authenticated back-office user into submitting a maliciously crafted request, the attacker can execute arbitrary JavaScript within the user’s administrative session, potentially compromising the security of the entire back-office environment.

Affected Version(s)

QloApps 0 <= 1.7.0

References

https://hackmd.io/@leediay/SyMoELioMx
third-party-advisory
https://github.com/Qloapps/QloApps/blob/v1.7.0/controller...
technical-description
https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/them...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.