CVE-2026-103587

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1

Description A reflected cross-site scripting issue exists in the back-office Hotel Reservation System Book Now search. The application fails to validate the date to and id room type parameters before copying them into template variables. This allows an attacker to execute a JavaScript payload within the session of an authenticated administrator by tricking them into following a specially crafted link.

Recommendations Update QloApps to version 1.7.1 or later. As a temporary mitigation, restrict access to the back-office Hotel Reservation System Book Now search or avoid using the date to and id room type parameters until the update is applied.