CVE-2026-103590 Details
Description
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and restriction_max_los parameters, executing arbitrary JavaScript in the victim's administrative session.
A reflected cross-site scripting vulnerability has been identified in QloApps versions through 1.7.0. This issue resides within the back-office room type editor, specifically in the length of stay fields. The vulnerability allows attackers to manipulate authenticated administrators into sending crafted POST requests. These requests can include malicious payloads in the 'restriction_min_los' and 'restriction_max_los' parameters, which would execute arbitrary JavaScript in the context of the victim's administrative session.
Users are advised to update to the latest version of QloApps, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| QloApps | <= 1.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | New CVE Received | [email protected] |