https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:00:54.867625+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-369882 EUVD-2026-369882 2026-10-02T11:00:54.869889+00:00 EUVD-2026-369882 https://cve.radiocsirt.org/vuln/fkie_cve-2026-92234 fkie_cve-2026-92234 2026-10-02T11:00:54.869919+00:00

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.

 https://cve.radiocsirt.org/vuln/ghsa-5r6g-j57j-3387 GHSA-5r6g-j57j-3387 2026-10-02T11:00:54.869949+00:00

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.