CVE-2026-110221: QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes featurepricename and impactvalue POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Back-office users who can access the AdminHotelFeaturePricesSettings form are the target. Exploitation requires an authenticated administrative session and user interaction with a crafted request.
What must an attacker do to trigger the vulnerability?
The attacker must cause an authenticated back-office user to submit crafted feature_price_name or impact_value POST values, such as through a malicious link or an auto-submitting form. The injected values are reflected unescaped when form validation fails.
Are systems affected by default?
The vulnerable form is part of the hotel reservation system module in QloApps through 1.7.0. The issue is reachable when a targeted back-office user can access the Advanced Price Rule settings form.
How can administrators determine whether they may be affected?
Check whether the deployment runs QloApps 1.7.0 or an earlier version and uses the AdminHotelFeaturePricesSettings interface. The relevant behavior occurs when validation fails and the submitted feature_price_name or impact_value values are rendered back into the form.