Is CVE-2026-92234 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92234?

CVE-2026-92234 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-92234

Description

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.