MEDIUM 5.1 NVD
CVE-2026-103588
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when the victim follows the link.
References
- https://github.com/Qloapps/QloApps
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminModulesPositionsCont
- https://github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5
- https://github.com/Qloapps/QloApps/pull/1899
- https://hackmd.io/@leediay/four-reflected-xss-qloapps
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-09-30 via NVD.
vulnfeed aggregates 9519 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.