# QloApps vulnerabilities Source: https://junglewise.ai/threats/vendors/qloapps Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/qloapps.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in QloApps: 0 in the last 7 days and 17 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116746, was published on 26 October 2026. 9 vulnerabilities in the last four weeks, up 29% on the four before (7). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 17 - All time: 19 (0 critical, 0 exploited in the wild) ## About QloApps QloApps is an open-source hotel reservation and booking system. ## Latest QloApps vulnerabilities - [CVE-2026-116746: QloApps missing authorization in qlohotelreview AddReview](https://junglewise.ai/threats/cve-2026-116746-qloapps-1-6-0-through-1-7-0-contains-a-missing-authorization) (medium, CVSS 5.3, published 26 Oct 2026) - [CVE-2026-116745: QloApps information disclosure in OrderConfirmationController](https://junglewise.ai/threats/cve-2026-116745-qloapps-through-1-7-0-contains-an-information-disclosure) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115326: QloApps insecure direct object reference in refund handling](https://junglewise.ai/threats/cve-2026-115326-qloapps-through-1-7-0-contains-an-insecure-direct-object) (medium, CVSS 5.4, published 22 Oct 2026) - [CVE-2026-110229: QloApps improper access control in AdminSlipController](https://junglewise.ai/threats/cve-2026-110229-qloapps-through-1-7-0-contains-an-improper-access-control) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-110226: QloApps broken access control in room type creation](https://junglewise.ai/threats/cve-2026-110226-qloapps-through-1-7-0-contains-a-broken-access-control) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-110224: QloApps reflected cross-site scripting in search configuration](https://junglewise.ai/threats/cve-2026-110224-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-110221: QloApps reflected cross-site scripting in AdminHotelFeaturePricesSettings](https://junglewise.ai/threats/cve-2026-110221-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-110219: QloApps reflected cross-site scripting in Additional Facilities](https://junglewise.ai/threats/cve-2026-110219-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-109393: QloApps insecure direct object reference in admin AJAX handlers](https://junglewise.ai/threats/cve-2026-109393-qloapps-through-1-7-0-contains-an-insecure-direct-object) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-105836: QloApps authorization bypass in AdminProductsController](https://junglewise.ai/threats/cve-2026-105836-qloapps-through-1-7-0-contains-an-authorization-bypass) (medium, CVSS 5.4, published 6 Oct 2026) - [CVE-2026-103590: QloApps reflected XSS in back-office room type editor](https://junglewise.ai/threats/cve-2026-103590-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-103589: QloApps reflected cross-site scripting in room type editor](https://junglewise.ai/threats/cve-2026-103589-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-103588: QloApps reflected XSS in Transplant module exceptions field](https://junglewise.ai/threats/cve-2026-103588-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-103587: QloApps reflected cross-site scripting in Hotel Reservation System](https://junglewise.ai/threats/cve-2026-103587-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-93988: QloApps path traversal in getEmailHTML](https://junglewise.ai/threats/cve-2026-93988-qloapps-through-1-7-0-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.5, published 19 Sep 2026) - [CVE-2026-92234: QloApps QloApps stored XSS in Hotel Reservation System feature management](https://junglewise.ai/threats/cve-2026-92234-qloapps-qloapps-stored-xss-in-hotel-reservation-system-feature) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2026-89268: QloApps XSS in back-office list filter via unescaped POST parameters](https://junglewise.ai/threats/cve-2026-89268-qloapps-xss-in-back-office-list-filter-via-unescaped-post) (medium, CVSS 5.4, published 12 Sep 2026) - [CVE-2026-25558: QloApps stored XSS via SVG upload in admin file manager](https://junglewise.ai/threats/cve-2026-25558-qloapps-stored-xss-via-svg-upload-in-admin-file-manager) (medium, CVSS 4.8, published 8 Jun 2026) - [CVE-2026-25861: QloApps weak password hashing in Tools.php](https://junglewise.ai/threats/cve-2026-25861-qloapps-weak-password-hashing-in-tools-php) (medium, CVSS 5.9, published 2 Jun 2026) ## Most severe QloApps vulnerabilities - [CVE-2026-93988: QloApps path traversal in getEmailHTML](https://junglewise.ai/threats/cve-2026-93988-qloapps-through-1-7-0-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.5, published 19 Sep 2026) - [CVE-2026-116745: QloApps information disclosure in OrderConfirmationController](https://junglewise.ai/threats/cve-2026-116745-qloapps-through-1-7-0-contains-an-information-disclosure) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-109393: QloApps insecure direct object reference in admin AJAX handlers](https://junglewise.ai/threats/cve-2026-109393-qloapps-through-1-7-0-contains-an-insecure-direct-object) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-25861: QloApps weak password hashing in Tools.php](https://junglewise.ai/threats/cve-2026-25861-qloapps-weak-password-hashing-in-tools-php) (medium, CVSS 5.9, published 2 Jun 2026) - [CVE-2026-92234: QloApps QloApps stored XSS in Hotel Reservation System feature management](https://junglewise.ai/threats/cve-2026-92234-qloapps-qloapps-stored-xss-in-hotel-reservation-system-feature) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2026-110219: QloApps reflected cross-site scripting in Additional Facilities](https://junglewise.ai/threats/cve-2026-110219-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-89268: QloApps XSS in back-office list filter via unescaped POST parameters](https://junglewise.ai/threats/cve-2026-89268-qloapps-xss-in-back-office-list-filter-via-unescaped-post) (medium, CVSS 5.4, published 12 Sep 2026) - [CVE-2026-110229: QloApps improper access control in AdminSlipController](https://junglewise.ai/threats/cve-2026-110229-qloapps-through-1-7-0-contains-an-improper-access-control) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-110226: QloApps broken access control in room type creation](https://junglewise.ai/threats/cve-2026-110226-qloapps-through-1-7-0-contains-a-broken-access-control) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-110224: QloApps reflected cross-site scripting in search configuration](https://junglewise.ai/threats/cve-2026-110224-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 5.4, published 13 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 29% on the four before (7). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 4 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 6 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## QloApps technologies - [QloApps](https://junglewise.ai/threats/technologies/qloapps): 19 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "QloApps vulnerabilities", https://junglewise.ai/threats/vendors/qloapps, 13 November 2026.