{"schema":"threatline.record/2","record":{"id":"CVE-2026-103587","aliases":[],"summary":"QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters","details":"QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript payload in these parameters that executes in an authenticated administrator's session when the victim follows the link.","categories":["Unclassified"],"product":"QloApps","vendor":"Webkul","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103587","source_modified_at":"2026-10-06T13:36:56.271Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"QloApps","vendor":"Webkul","versions":[{"version":"0","lessThanOrEqual":"1.7.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00182,"percentile":0.07396,"score_date":"2026-10-23"},"published_at":"2026-09-30T23:02:32.852Z","modified_at":"2026-10-06T13:36:56.271Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103587","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-06T13:36:56.271Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103587","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/pull/1884","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/commit/1d06fd302a935d68203dbdb341d89482621769d7","tags":["patch"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/hotel_rooms_booking/helpers/view/_partials/booking-rooms.tpl","tags":["technical-description"]},{"source":"CVE List","url":"https://hackmd.io/@leediay/reflected-xss-qloapps-via-booking-now","tags":["exploit"]},{"source":"CVE List","url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-book-now-search-parameters","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-01T15:39:58.785247Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T13:36:56.271Z","content_hash":"414977e508cee85d9ea3667bec61d82fc870857e6e8bb88f3256b074ddf03554"}}