QloApps CVE-2026-103589

Exploitation requires an authenticated back-office (administrative) user of QloApps through 1.7.0 and that user being induced to submit a crafted POST request to the room type editor with a malicious payload in the room_num, floor, or comment fields, which are reflected unescaped into HTML input value attributes (admin-dev/themes/default/template/controllers/products/configuration.tpl). Limiting factors: the attacker cannot self-trigger it - a logged-in back-office victim must perform the submission (active user interaction), raising the social-engineering bar; it is reflected (non-persistent), so each exploitation needs a fresh lure; and the patched version is already available. These conditions meaningfully constrain real-world risk below the raw network-attack-vector impression.

This is a reflected XSS (CWE-79) in the QloApps back-office room type editor, and the real-world risk is moderate-to-low despite being present in an administrative interface. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/PR:L/UI:P/VC:L/VI:L/VA:N) scores 5.1, and this is well-calibrated: exploitation is network-reachable but gated behind PR:L (the victim must be an authenticated back-office user) and UI:P/active user interaction (the victim must be induced to submit a crafted POST request). Impact is limited (VC:L/VI:L) - script execution in the admin session, not direct full compromise. No EPSS score was provided and the CVE is not in CISA KEV, so there is no confirmed active exploitation; this is a self-reported/researcher-reported issue (VulnCheck) with a vendor patch already available. A detailed public technical writeup exists (hackmd '@leediay/four-reflected-xss-qloapps') describing the flaw, and the patch diff is public, which materially lowers the bar to craft a working payload - but no weaponized exploit or active exploitation is confirmed. Net: a legitimate issue to patch, but not an emergency; its severity ceiling is capped by the authenticated-victim + user-interaction requirements. Note one data-quality conflict: the input Tags list 'Microsoft', which is incorrect - the affected product is Webkul's QloApps per the CPE and all references.

An attacker crafts a malicious page or link that auto-submits a POST request to the room type editor containing a JavaScript payload in the room_num, floor, or comment field. The attacker then social-engineers an authenticated back-office/admin user into triggering it (e.g., clicking a link while logged in), causing the unescaped value to be reflected into an input attribute and executed in the admin's session. A public technical writeup detailing the four reflected XSS vectors and the patch diff are available, so payload construction is straightforward, though no packaged exploit is confirmed.