CVE-2026-92234: QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the childfeatures parameter.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Back-office users of QloApps through 1.7.0 who can access the Hotel Reservation System feature management page are exposed if they follow a crafted link. The injected JavaScript executes in the affected user's administrative session.
What does an attacker need to exploit it?
An attacker needs a crafted link containing a malicious child_features parameter and must induce an authenticated back-office user to follow it. The issue does not require the attacker to already hold back-office credentials.
Which input and page are involved?
The vulnerable input is the child_features parameter. It is reflected without escaping in validation error messages on the Hotel Reservation System feature management page.