PrestaShop-CVE-2018-19126

PrestaShop Back Office Remote Code Execution CVE-2018-19126 This is the PoC for CVE-2018-19126, chaining multiple vulnerabilities in PrestaShop Back Office to trigger deserialization via phar to achieve remote code execution. Prerequisite: PrestaShop 1.6.x before 1.6.1.23 or 1.7.x before 1.7.4.4...

Zphisher-GUI-Back_office

Mi sitio web: https://microjoan.com Mi canal de YouTube: https://www.youtube.com/c/MicroJoan AVISO LEGAL Este kit contiene materiales que pueden ser potencialmente dañinos o peligrosos para las redes sociales. Consulta las leyes de tu provincia/país antes de acceder, usar o de cualquier otra form...

CVE-2026-105836

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

EUVD-2026-90437

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103589

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103590

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590

QloApps versions through 1.7.0 are affected by a reflected cross-site scripting (XSS) vulnerability within the back-office room type editor. The flaw exists in the length of stay fields , where an attacker can craft POST requests containing malicious payloads in the restriction_min_los and restri...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103589

QloApps versions up to and including 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the back-office room type editor. The root cause is the failure to properly escape values from the room_num , floor , and comment fields when used in input attributes. An attac...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103588

QloApps versions through 1.7.0 are susceptible to a reflected cross-site scripting (XSS) vulnerability located in the exceptions field of the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload within the exceptions parameter . If an authen...

PT-2026-103628

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office room type editor. The application fails to properly escape the room num, floor, and comment field values within input attributes. This...

CVE-2026-103588: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103590: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

PT-2026-103629

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.0 Description A reflected cross-site scripting issue exists in the back-office room type editor's length of stay fields. Authenticated administrators can be induced to submit crafted POST requests containing...

PT-2026-103627

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload in the exceptions parameter. This...

CVE-2026-103589: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

EUVD-2026-88580

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...