CVE-2026-103589 in QloApps
Riassunto
di MITRE • 01/10/2026
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious payloads to execute arbitrary JavaScript in the victim's administrative session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.