CVE-2026-110219QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

Description

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://hackmd.io/@leediay/SyMoELioMx third-party-advisory
• https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/room_type… technical-description
• https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminRoomType… technical-description
• Pull Request #1809 (feature removed on develop, unreleased) patchissue-tracking
• https://github.com/Qloapps/QloApps product
• VulnCheck Advisory: QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field third-party-advisory