CVE-2026-103589: QloApps through 1.7.0 Reflected XSS via Room Type Editor
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious payloads to execute arbitrary JavaScript in the victim's administrative session.
Affected Software
Event History
Frequently Asked Questions
Who needs to be targeted for this issue to be exploited?
An attacker must induce an authenticated QloApps back-office user to submit a crafted POST request. The JavaScript executes in that victim's administrative session.
Which inputs are affected?
The vulnerable room type editor fails to escape the room_num, floor, and comment field values when rendering them in input attributes.
Are unauthenticated users directly exposed?
The described attack requires an authenticated back-office victim and user interaction. The provided information does not describe direct execution in an unauthenticated user's session.