CVE-2026-89268
Received Received - Intake

Stored XSS in QloApps Admin Panel via Unsanitized List Filter Parameters

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-89268
EUVD
EUVD-2026-76773

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qloapps qloapps to 1.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in QloApps versions up to 1.7.0. It occurs because the application does not properly escape filter values in the list_header.tpl template when rendering back-office list filter POST parameters into HTML input value attributes. Attackers can craft malicious POST requests containing JavaScript payloads that execute in the context of an authenticated user's session.

Detection Guidance

To detect this vulnerability, inspect the QloApps admin panel for XSS payloads in list filter parameters. Check POST requests to admin controllers for unusual JavaScript in filter values. Review the list_header.tpl template for unescaped input rendering. Monitor admin logs for unauthorized actions or data access.

Impact Analysis

Successful exploitation could allow attackers to read sensitive administrative data, perform unauthorized actions, steal session cookies, or deface the admin interface. Since it targets the admin panel, attackers could gain full control over the QloApps installation, manipulate booking data, or access customer information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Exposure of customer information or administrative actions may result in non-compliance, potential fines, and reputational damage.

Mitigation Strategies

Upgrade QloApps to a patched version if available. Restrict admin panel access to trusted IPs. Apply the security patch from Pull Request #1801. Monitor for unusual activity in admin logs. Temporarily disable list filter features if unpatched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89268. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart