EUVD-2026-99009

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing...

CVE-2026-110224

QloApps versions through 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the AdminSearchConfController::processSave() function. The root cause is that the application echoes rejected alias and search values without proper escaping during validation errors. An a...

CVE-2026-110221 QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes featurepricename and impactvalue POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted reque...

CVE-2026-110219 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

CVE-2026-110219 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

CVE-2026-104075

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

CVE-2026-104075 TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

CVE-2026-104075 TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

CVE-2026-104075

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 are susceptible to an authentication bypass vulnerability in the web management login endpoint (POST /tvu/Login ). By submitting a crafted HTTP request with an empty or absent UserName parameter, remote unauthenticated ...

EUVD-2026-95250

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

PT-2026-108187

Name of the Vulnerable Software and Affected Versions TVU Networks Receiver/Transceiver devices versions prior to 7.9 Description An authentication bypass exists in the web management login endpoint 'POST /tvu/Login'. Remote unauthenticated attackers can obtain an administrative session by...

CVE-2026-104075: Authentication Bypass Using an Alternate Path or Channel

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

CVE-2026-102161

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

EUVD-2026-93958

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

CVE-2026-102161 Security Advisory 0190

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

CVE-2026-102161

An unauthenticated attacker positioned on an adjacent private network —or an attacker routed through a reverse proxy/load balancer that forwards client headers—can forge their source IP address . This vulnerability allows the attacker to gain administrative session privileges on the CV-CUE backen...

PT-2026-107147

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

CVE-2026-102161: Use of Hard-coded Credentials

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...