CVE-2026-110221QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

Description

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://hackmd.io/@leediay/SyMoELioMx third-party-advisory
• https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/hotel_fea… technical-description
• https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/hotel_fea… technical-description
• https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelFea… technical-description
• https://github.com/Qloapps/QloApps product
• VulnCheck Advisory: QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value third-party-advisory