CVE-2026-110224

Published: Ott 13, 2026 Last Modified: Ott 13, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none

Description

AI Translation Available

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.

79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Integrity Availability
Potential Impacts:
Bypass Protection Mechanism Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML, Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
https://hackmd.io/@leediay/SyMoELioMx
https://hackmd.io/@leediay/SyMoELioMx
https://github.com/Qloapps/QloApps
https://github.com/Qloapps/QloApps
https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes…
https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/al…
https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/…
https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminSearchCon…
https://hackmd.io/@leediay/SyMoELioMx
https://hackmd.io/@leediay/SyMoELioMx
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-…
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-se…