CVE-2026-89268
mediumQloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template.
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Qloapps/QloApps disclosure@vulncheck.com
- https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/helpers/list/... disclosure@vulncheck.com
- https://github.com/Qloapps/QloApps/commit/153ec1c8567798bd99155098ecc0a340e38f25bf disclosure@vulncheck.com
- https://github.com/Qloapps/QloApps/pull/1801 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-list-filter-p... disclosure@vulncheck.com