CVE-2026-103589

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1

Description A reflected cross-site scripting issue exists in the back-office room type editor. The application fails to properly escape the room num, floor, and comment field values within input attributes. This allows an attacker to trick authenticated back-office users into submitting crafted POST requests containing malicious payloads, leading to the execution of arbitrary JavaScript within the victim's administrative session.

Recommendations Update QloApps to version 1.7.1 or later. As a temporary mitigation, restrict access to the back-office room type editor to only trusted administrators.