Webkul QloApps up to 1.7.0 Room Type Editor room_num/floor/comment cross site scripting

Summaryinfo

A vulnerability classified as problematic has been found in Webkul QloApps up to 1.7.0. Affected by this vulnerability is an unknown functionality of the component Room Type Editor. Performing a manipulation of the argument room_num/floor/comment results in cross site scripting. This vulnerability is reported as CVE-2026-103589. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Webkul QloApps up to 1.7.0. It has been classified as problematic. This affects some unknown processing of the component Room Type Editor. The manipulation of the argument room_num/floor/comment with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious payloads to execute arbitrary JavaScript in the victim's administrative session.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-103589 since 10/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Webkul

Name

• QloApps

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion