CVE-2026-103588

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1

Description A reflected cross-site scripting issue exists in the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload in the exceptions parameter. This payload executes within the session of an authenticated administrator who follows the link.

Recommendations Update QloApps to version 1.7.1 or later. As a temporary mitigation, restrict access to the back-office Transplant a module form or avoid using the exceptions parameter.