QloApps EUVD-2026-99009

Requires an authenticated back-office (administrator) session in QloApps ≤1.7.0 and active victim interaction: the attacker cannot self-trigger the flaw but must induce a logged-in admin to submit a crafted request to AdminSearchConfController::processSave() whose alias or search value fails validation, since the rejected value is reflected unescaped into the alerts.tpl validation-error output. Exploitation is LIMITED by three factors: the vulnerable endpoint is admin-only (PR:L), the payload only fires on a validation-rejected value echoed back, and success depends on social-engineering the victim into submitting the request (UI:P). It affects the standard back-office and does not require a non-default configuration.

This is a moderate, not high-priority, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N, score 5.1) describes a reflected XSS requiring both an authenticated back-office user (PR:L) and active user interaction (UI:P) - the victim must be lured into submitting a crafted request to AdminSearchConfController::processSave(). SSVC reinforces a measured posture: Exploitation=poc (proof-of-concept only), Automatable=no (each attack needs a targeted, socially-engineered interaction rather than mass scanning), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of widespread or active exploitation; the exploitation status is publicly available exploit code exists (a HackMD write-up and a VulnCheck advisory are referenced), which is distinct from in-the-wild use. No signals conflict: all sources consistently point to a low-to-moderate, interaction- and privilege-gated client-side flaw. The main limiting factor is that exploitation presupposes a logged-in administrator who can be tricked, confining real-world risk to targeted phishing of back-office staff rather than broad opportunistic attack. EPSS data is missing and should be checked to confirm the low expected-exploitation probability implied by the other signals.

An attacker crafts a request to the QloApps back-office search-alias configuration endpoint containing a malicious payload in the alias or search value, then phishes a logged-in administrator into submitting it (e.g., via a prepared link or auto-submitting form). Because processSave() echoes the rejected value unescaped into the validation-error alert, the script executes in the administrator's authenticated session, enabling session-context actions on their behalf. Proof-of-concept exploit code is publicly documented, but exploitation requires both an authenticated victim and their interaction.