CVE-2026-103590

Deferred Deferred - Pending Action

Reflected XSS in QloApps Back-Office Room Type Editor

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulnCheck

Description

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and restriction_max_los parameters, executing arbitrary JavaScript in the victim's administrative session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-103590

EUVD

EUVD-2026-90438

Affected Vendors & Products

Vendor	Product	Version / Range
qloapps	qloapps	1.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

QloApps through version 1.7.0 has a reflected cross-site scripting (XSS) vulnerability in the back-office room type editor. This flaw allows attackers to inject malicious JavaScript code via the restriction_min_los and restriction_max_los parameters in crafted POST requests. When an authenticated administrator submits these requests, the malicious payload executes in their administrative session.

Detection Guidance

This vulnerability is specific to QloApps version 1.7.0 or earlier and involves reflected XSS in the back-office room type editor. Detection requires checking for suspicious POST requests to the room type editor with malicious payloads in the restriction_min_los and restriction_max_los parameters.

Impact Analysis

An attacker could exploit this vulnerability to steal session cookies or other sensitive data from an authenticated administrator. This could lead to unauthorized access to the QloApps admin panel, allowing attackers to modify settings, steal data, or perform other malicious actions within the application.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. If exploited, it may result in data breaches, unauthorized data access, or data theft, which are serious violations of these regulations.

Mitigation Strategies

Upgrade QloApps to a version beyond 1.7.0 immediately. If upgrading is not possible, restrict access to the back-office room type editor to trusted administrators only and monitor for unusual POST requests containing script payloads in the specified parameters.

Hi! I’m here to help you understand CVE-2026-103590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70