CVE-2026-103588
QloApps through 1.7.0 Reflected XSS via exceptions field
Webkul QloApps
CVSS
5.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 5 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when the victim follows the link.
Text from CVE List
Affected versions 1
- QloAppsaffected: all versions through 1.7.0CVE List
References 6
- github.com/Qloapps/QloApps/pull/1899Fixvia CVE List
- github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5Fixvia CVE List
- vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-exceptions-fieldAdvisoryvia CVE List
- hackmd.io/@leediay/four-reflected-xss-qloappsExploitvia CVE List
- github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminModulesPositionsController.phpReferencevia CVE List
- github.com/Qloapps/QloAppsReferencevia CVE List