CVE-2026-92234

Received Received - Intake

QloApps 1.7.0 Reflected XSS in Hotel Reservation System

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-92234

Affected Vendors & Products

Vendor	Product	Version / Range
qloapps	qloapps	1.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

QloApps through version 1.7.0 has a reflected cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page. Authenticated back-office users can execute injected JavaScript in their administrative session by following a crafted link that includes the child_features parameter, which is not properly escaped in validation error messages.

Detection Guidance

This vulnerability involves reflected unescaped input in the Hotel Reservation System feature management page of QloApps. To detect it, inspect HTTP responses for the back-office validation error messages containing the child_features parameter. Look for JavaScript code execution in error messages after submitting crafted links with the child_features parameter.

Impact Analysis

An attacker with access to a crafted link could steal session cookies, perform actions on behalf of the user, or manipulate the admin interface. This could lead to unauthorized changes, data theft, or further compromise of the QloApps system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Upgrade QloApps to a version beyond 1.7.0 where this issue is fixed. If immediate upgrade is not possible, restrict access to the back-office interface to trusted networks or users only. Implement input validation and output encoding for the child_features parameter to prevent JavaScript injection in error messages.

Hi! I’m here to help you understand CVE-2026-92234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70