CVE-2026-92234— QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
Quick assessment
Affected
Webkul QloApps
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
QloApps 1.7.0 及更早版本在酒店预订系统功能管理页面中，将未经转义的子功能名称反射到后台验证错误消息中。经过身份验证的后台用户可以通过访问精心构造的链接，在其管理会话中通过 child_features 参数执行注入的 JavaScript 代码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92234
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
Source: CVE Program / CVE List V5
Vulnerability Description
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92234
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92234
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-92234 (2)
Vendor Advisories for CVE-2026-92234 (1)
Security Blog Posts for CVE-2026-92234 (1)
Other References for CVE-2026-92234 (1)
IV. Related Vulnerabilities
Same product: QloApps
-
CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Paramete -
CVE-2026-75498
Webkul QloApps SQL injection -
CVE-2026-75497
Webkul QloApps SQL injection -
CVE-2026-75496
Webkul QloApps improper file upload validation -
CVE-2026-25558
QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File M
Same vendor: Webkul
-
CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Paramete -
CVE-2026-75498
Webkul QloApps SQL injection -
CVE-2026-75497
Webkul QloApps SQL injection -
CVE-2026-75496
Webkul QloApps improper file upload validation -
CVE-2026-75082
Webkul Bagisto Customer-Registration Notification Email regi
Same weakness: CWE-79
-
CVE-2026-15639
Reflected Cross-Site Scripting -
CVE-2026-92257
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 -
CVE-2026-76872
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via D -
CVE-2026-76873
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via D -
CVE-2026-76867
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Ro
V. Comments for CVE-2026-92234
No comments yet