CVE-2026-110224: QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors

Q: Is a publicly reachable QloApps instance vulnerable without an administrator interacting with it?

Exploitation requires an authenticated back-office user to submit an attacker-crafted request. The provided CVSS vector also indicates user interaction is required.

Q: Which administrative function is involved in exploitation?

The vulnerable handling occurs when saving search alias configuration through AdminSearchConfController::processSave(). Rejected alias and search values are reflected in validation-error output without escaping.

Published Oct 13, 2026

Updated

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.

Affected Software

1 affected component

QloApps QloApps<=1.7.0

Event History

Oct 13, 2026

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Is a publicly reachable QloApps instance vulnerable without an administrator interacting with it?

Exploitation requires an authenticated back-office user to submit an attacker-crafted request. The provided CVSS vector also indicates user interaction is required.

Which administrative function is involved in exploitation?