CVE-2026-110221 in QloApps
要約
〜によって MITRE • 2026年10月13日
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.