CVE-2026-89268 — QloApps through 1.7.0 Reflected XSS via List Filter Parameters
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce au…
Published: 2026-09-12 · CVSS: 5.1 · CVSS 4.0
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7