CVE-2026-92234
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.
Risk Assessment
Execution of injected JavaScript in an administrator's session can lead to session data theft or unauthorized actions within the back-office panel.
Recommendation
Update QloApps to a version newer than 1.7.0, and until then avoid clicking untrusted links while logged into the administrative session.
Other vulnerabilities in QloApps
See all- CVE-2025-67325Critical
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
- CVE-2026-89268Medium
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
- CVE-2026-25558Medium
QloApps through version 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager. Authenticated administrators can inject malicious JavaScript by uploading crafted SVG files with embedded event handlers such as onload.
- CVE-2026-25861Medium
QloApps through version 1.7.0 uses the weak MD5 algorithm for password hashing in the Tools::encrypt() function. Attackers can perform offline brute-force attacks on these hashes, with the risk compounded by auto-generated 8-character passwords during guest-to-customer conversion.
Original NVD description (English source)
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.