QloApps CVE-2026-110221

Exploitation requires (1) a victim who is an authenticated QloApps back-office administrator with access to the hotel reservation module's advanced price-rule settings, and (2) that victim to interact by following a crafted link or triggering an auto-submitting form targeting the AdminHotelFeaturePricesSettings controller. The payload is reflected via the feature_price_name and impact_value POST parameters, and crucially fires only on the validation-failure code path (the unescaped echo at form.tpl lines 43/185 after the validation branch at the controller). Limiting factors: no anonymous/pre-auth path exists (the endpoint is back-office only), mandatory user interaction is required, and impact is confined to script execution in the admin's browser session rather than direct server compromise.

This is a medium-severity reflected XSS (CWE-79) in QloApps' AdminHotelFeaturePricesSettings advanced price-rule form, confirmed by the provided CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) scoring 5.1. The real-world risk is moderate and gated by two factors: the attack requires an already-authenticated back-office administrator (PR:L) AND active user interaction (UI:P) - the victim must follow a crafted link or submit an auto-submitting form. No EPSS score, KEV listing, or SSVC decision data was supplied, so automatability and exploitation-in-the-wild cannot be assessed from the input. There is no public exploit identified at time of analysis, though a third-party technical writeup (hackmd.io) and a VulnCheck advisory describe the flaw in detail, which lowers the effort to reproduce. Impact is limited to low confidentiality/integrity within the admin's browser session (VC:L/VI:L/VA:N) - not server-side RCE - so despite being an admin-context XSS this is a real-but-contained priority rather than an emergency. Note the conflicting signal that the back-office endpoint is only reachable by authenticated users, yet exploitation hinges on social-engineering a privileged victim rather than attacker-held privileges; verify the intended PR scoring with the vendor/NVD.

An attacker crafts a malicious link or auto-submitting HTML form targeting the AdminHotelFeaturePricesSettings endpoint with JavaScript in the feature_price_name or impact_value POST fields, then phishes a logged-in QloApps back-office administrator into opening it. When the form's server-side validation fails, the values are echoed back unescaped, executing the attacker's JavaScript in the admin's authenticated session. No public exploit code is identified, but a VulnCheck advisory and a hackmd writeup document the exact parameters and sink.