CVE-2026-110224 — QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped …
Published: 2026-10-13 · CVSS: 5.1 · CVSS 4.0
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7