CVE-2026-110221 QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes featurepricename and impactvalue POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted reque...