CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103589

QloApps versions up to and including 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the back-office room type editor. The root cause is the failure to properly escape values from the room_num , floor , and comment fields when used in input attributes. An attac...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

bidnow-warroom-ctf

BidNow Live — War Room CTF Demo Build A third, standalone C...

PT-2026-103629

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.0 Description A reflected cross-site scripting issue exists in the back-office room type editor's length of stay fields. Authenticated administrators can be induced to submit crafted POST requests containing...

PT-2026-103628

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office room type editor. The application fails to properly escape the room num, floor, and comment field values within input attributes. This...

CVE-2026-103590: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

PT-2026-103626

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Hotel Reservation System Book Now search. The application fails to validate the date to and id room type parameters before copying the...

CVE-2026-103589: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100687: Exposure of Sensitive Information to an Unauthorized Actor

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

PT-2026-99358

Name of the Vulnerable Software and Affected Versions Budibase Server versions prior to 3.45.0 Description The software fails to redact plaintext datasource credentials when broadcasting external table updates to the Builder collaboration websocket room. Users with Builder access can intercept...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

PT-2026-95745

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 2.15.34 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...

PT-2026-95432

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description When operating in prefill/decode disaggregation mode with the Mooncake KV transfer backend, the system fails to validate bootstrap room values. This allows for unbounded transfer state allocation...

CVE-2026-86216

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...