QloApps EUVD-2026-99260

Exploitation requires (1) a valid authenticated QloApps back-office session at low privilege (PR:L) - the vulnerable endpoint is the admin Additional Facilities / global demand form (AdminRoomTypeGlobalDemand), not a public page; and (2) victim interaction (UI:P) - the authenticated admin must be induced to submit the crafted request whose price value fails validation and is reflected unescaped. Limiting factors: no self-service or unauthenticated path, dependence on social engineering of an existing admin, and applicability only to QloApps versions up to and including 1.7.0 (patched in PR #1809). These constraints make realistic risk notably lower than the network attack vector alone suggests.

This is a medium-severity reflected XSS (CVSS 4.0 base 5.1) whose real-world urgency is low across every available signal. The CVSS vector requires AV:N but also PR:L (an authenticated back-office session) and UI:P (the victim must be induced to submit a crafted request), which together block opportunistic mass exploitation. CISA's SSVC framework reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial - i.e., no observed exploitation, not scriptable at scale, and only partial impact. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The CVE is not in CISA KEV and no explicit POC flag was supplied, though a third-party technical write-up (hackmd) and a VulnCheck advisory document the flaw. Signals are consistent rather than conflicting: a real but low-priority vulnerability. The one caveat is attack vector - AV:N is technically correct (the payload travels over the network) but exploitation is gated behind an authenticated admin victim and social engineering, so treat it as an authenticated/assisted issue rather than a remote unauthenticated one. Note also the input Tags include 'Microsoft', which is erroneous (see data_quality_flags) and should not factor into targeting assumptions.

An attacker crafts a request (or link/form) carrying a malicious script in the price parameter of the back-office Additional Facilities form, then socially engineers an already-authenticated QloApps back-office administrator into submitting it. When the value fails validation it is re-rendered unescaped, executing attacker JavaScript inside the admin session; a technical write-up exists but no weaponized public exploit code is confirmed in the input.