QloApps CVE-2026-103588

Exploitation requires an authenticated back-office administrator session in QloApps (through 1.7.0) and that the victim follow an attacker-crafted link - the payload lands in the 'exceptions' parameter of the AdminModulesPositions 'Transplant a module' form, whose displayModuleExceptionList() reflects the value unescaped into an HTML input. Limiting factors: the attacker cannot exploit this without an admin being logged in and clicking the malicious link (UI:P/PR:L), the XSS is reflected (non-persistent, so each victim must be individually lured), and impact is bounded to the admin's browser session (Low C/I, no availability impact). Patched installations (PR #1899 / commit 7ed467d, which applies Tools::safeOutput) are not affected.

This is a genuinely low-to-moderate priority issue, not a high-CVSS-but-overrated flaw - the vendor's own CVSS 4.0 score of 5.1 (Medium) already reflects its constrained impact. The 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/SC:L/SI:L) shows network reach but three meaningful limiters: it requires an authenticated administrator (PR:L), passive user interaction (UI:P - the admin must follow the attacker's link), and yields only Low confidentiality/integrity impact (reflected, non-persistent script execution). No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation. Public proof-of-concept detail does exist (the hackmd write-up by @leediay documenting four reflected XSS in QloApps, plus the VulnCheck advisory), so exploitation is well-understood even if not automated. Signals are internally consistent: the reflected, admin-targeted, interaction-dependent nature matches the modest score. A patch is confirmed available (vendor PR #1899 / commit 7ed467d), which should be the primary remediation driver rather than fear of mass exploitation.

An attacker crafts a URL to the QloApps back-office AdminModulesPositions controller with a JavaScript payload in the exceptions parameter, then lures a logged-in administrator (via phishing/chat) into clicking it. When the admin's browser renders the 'Transplant a module' exceptions form, the unescaped value reflects into the input and the script executes in the admin's session, enabling session/CSRF-token theft or back-office actions on the admin's behalf. Public write-ups (hackmd @leediay and the VulnCheck advisory) document the technique, so working exploit knowledge is available.