EUVD-2026-35071
GHSA-xcx6-j7v3-9h57
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.
AnalysisAI
Stored cross-site scripting in QloApps through 1.7.0 enables authenticated administrators to inject persistent JavaScript into the application by uploading SVG files containing malicious event handlers (e.g., onload) via the admin file manager. Any user who subsequently views the uploaded file triggers the embedded script in their browser, crossing a security boundary (S:C) from the admin upload context into arbitrary victim sessions. Publicly available exploit code exists per VulnCheck and a linked GitHub issue; no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
QloApps is an open-source hotel reservation and booking platform. The vulnerable component is the admin file manager, which fails to sanitize SVG content before storing and serving it. SVG is an XML-based vector image format that natively supports embedded scripting through event handlers such as onload, onclick, and onerror - making it a well-known XSS vector when user-supplied SVGs are rendered inline by browsers rather than treated as untrusted downloads. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the application does not strip or encode script-capable constructs from uploaded SVG files before they are served to other users. The affected CPE is cpe:2.3:a:qloapps:qloapps:*:*:*:*:*:*:*:*, covering all tracked versions through 1.7.0.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified at time of analysis - patch status should be actively monitored via the upstream GitHub issue at https://github.com/Qloapps/QloApps/issues/1728 and the VulnCheck advisory. As an immediate compensating control, administrators should remove SVG from the list of permitted upload file types in the admin file manager; this directly eliminates the attack surface with no functional loss for most hotel-booking use cases, as SVG is rarely required for operational content. If SVG uploads cannot be disabled, configure the web server to serve files from the upload directory with the Content-Disposition: attachment header, which forces browser download rather than inline rendering and prevents JavaScript execution - note this may break image preview functionality. Additionally, implement server-side SVG sanitization using a library such as svg-sanitizer to strip script-capable elements and event handler attributes before storage. Access to the admin file manager should be restricted to the minimum necessary personnel, and admin account credentials should be audited for reuse or compromise given that PR:H is the primary exploitation barrier.
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_p
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploadi
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remo
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executa
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credenti
SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsani
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today