CVE-2026-103590

MEDIUM 5.4

QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and restriction_max_los parameters, executing arbitrary JavaScript in the victim's administrative session.

CWE	CWE-79
Vendor	webkul
Product	qloapps
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for webkul qloapps

Be the first to know when new medium vulnerabilities affecting webkul qloapps are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Webkul / QloApps

0 ≤ 1.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Qloapps/QloApps/pull/1899 github.com: https://github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5 github.com: https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/controllers/products/lengthofstay.tpl hackmd.io: https://hackmd.io/@leediay/four-reflected-xss-qloapps github.com: https://github.com/Qloapps/QloApps vulncheck.com: https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-length-of-stay-fields

Credits

leediay153