CVE-2026-103587: QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript payload in these parameters that executes in an authenticated administrator's session when the victim follows the link.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
QloApps installations through version 1.7.0 are affected when an authenticated back-office administrator can be induced to follow a crafted link to the Hotel Reservation System Book Now search.
What does an attacker need to exploit it?
The attacker needs to craft a link with JavaScript payloads in the date_to or id_room_type search parameters and persuade an authenticated administrator to open it. No attacker authentication is stated as necessary.
Which part of the application is affected?
The affected functionality is the back-office Hotel Reservation System Book Now search. The vulnerable parameters are date_to and id_room_type.