QloApps CVE-2026-103587

Exploitation requires: (1) a victim who is an authenticated QloApps back-office administrator (PR:L) - the vulnerable endpoint is the admin Hotel Reservation System 'Book Now' search (AdminHotelRoomsBookingController); (2) user interaction - the admin must follow an attacker-supplied link containing the payload (UI:P/UI:R), as this is reflected (non-persistent) XSS; and (3) the target running QloApps 1.7.0 or earlier with the unpatched date_to / id_room_type parameters copied into Smarty template variables without validation. Limiting factors: no unauthenticated path, no self-propagation, and reliance on social engineering of a privileged user, which meaningfully constrains real-world exploitation.

This is a genuine but modest-severity issue, not a top-tier priority. The vendor CVSS 4.0 score of 5.1 (medium) aligns with the fundamentals: a reflected XSS requires an authenticated administrator (PR:L) to be socially engineered into following a crafted link (UI:P / UI:R), which substantially gates exploitation. Impact is limited to the browser context - VC:L/VI:L/SC:L/SI:L with no availability impact - consistent with payload execution in an admin session rather than direct server compromise. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; status is best described as targeted-potential rather than widespread. However, detailed public write-ups exist (two hackmd articles and a VulnCheck advisory describing the Book Now search vectors), so exploitation detail is public even if no packaged exploit tool is. The requirement to lure a logged-in back-office admin is the principal real-world limiter. Net: patch in normal cadence; this is a real finding but low operational urgency.

An attacker crafts a malicious back-office URL embedding a JavaScript payload in the date_to or id_room_type parameters of the Hotel Reservation System 'Book Now' search and delivers it (e.g., via email or chat) to a QloApps administrator. When the authenticated admin follows the link, the unvalidated parameters are reflected into Smarty template variables and the script executes in their session, enabling session/CSRF-token theft or admin actions. Public technical write-ups detailing the vectors exist, lowering the effort to reproduce.