EUVD-2026-76773
GHSA-crrq-mjw6-39qp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no credentials (PR:N); only the victim admin needs auth; UI:R for social-engineered form submission; S:C per standard reflected-XSS browser-context scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
AnalysisAI
Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template list_header.tpl interpolating $smarty.post filter parameters directly into HTML input value attributes without the |escape:'html':'UTF-8' modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be an authenticated QloApps back-office administrator with an active session at the time the malicious POST request is submitted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (AV:N/AC:L/PR:L/UI:P) reflects moderate severity appropriate to a POST-delivered reflected XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available via GitHub PR #1801 and commit 153ec1c8567798bd99155098ecc0a340e38f25bf (https://github.com/Qloapps/QloApps/pull/1801), which adds `|escape:'html':'UTF-8'` Smarty output modifiers to all affected `$smarty.post` interpolations in `list_header.tpl`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_p
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploadi
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remo
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3
Stored cross-site scripting in QloApps through 1.7.0 enables authenticated administrators to inject persistent JavaScrip
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executa
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credenti
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today