CVE-2026-110219

Deferred Deferred - Pending Action

Reflected XSS in QloApps Back-Office via Price Parameter

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110219

EUVD

EUVD-2026-99260

Affected Vendors & Products

Vendor	Product	Version / Range
Webkul	QloApps	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-110219 is a reflected cross-site scripting (XSS) vulnerability in QloApps versions up to 1.7.0. It allows attackers to inject malicious scripts via the price parameter in the back-office Additional Facilities form. When an authenticated user submits a crafted request, the unescaped price value executes JavaScript in the administrative session after validation fails.

Detection Guidance

To detect this reflected XSS vulnerability in QloApps, monitor HTTP requests to the back-office Additional Facilities form for unescaped price parameter values. Check if the price field in POST requests to modules/hotelreservationsystem/controllers/admin/AdminRoomTypeGlobalDemand.php contains JavaScript payloads. Inspect server responses for echoed unsanitized input in the price field.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of an authenticated back-office user. This could lead to unauthorized actions, theft of sensitive administrative data, or manipulation of hotel settings. Attackers could trick users into submitting crafted requests to trigger the XSS.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA due to the exposure of sensitive administrative data and financial information. The reflected XSS allows attackers to execute scripts in authenticated sessions, potentially stealing credentials or sensitive data. The missing authorization and credit slip vulnerabilities enable unauthorized access to financial records across hotels, violating data segregation and access control requirements under GDPR and HIPAA.

Mitigation Strategies

Immediately update QloApps to the latest patched version. Apply input validation and output encoding to the price parameter in the Additional Facilities form. Restrict access to the back-office interface to trusted users only. Review server logs for suspicious POST requests to the vulnerable endpoint.

Hi! I’m here to help you understand CVE-2026-110219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70