CVE-2026-110219: QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Back-office users are the target, because the injected script executes in an authenticated administrative session. An attacker can operate remotely but needs to induce that user to submit a crafted request.
Which input and workflow are involved?
The affected input is the price parameter on the back-office Additional Facilities form. The payload is reflected when price validation fails and the submitted value is re-rendered without escaping.
Does exploitation require authentication or user interaction?
The attacker does not need prior authentication, but exploitation requires a back-office user to be authenticated and to submit the attacker-crafted request. The reported vector has network access, low attack complexity, low privileges required, and user interaction.
What versions are identified as affected?
QloApps through version 1.7.0 is identified as affected. The provided data does not identify a fixed version or a workaround.