QloApps through version 1.7.0 improperly neutralizes input during web page generation in the back-office list helper template. Specifically, POST parameters for list filters are rendered into HTML input value attributes without escaping, enabling authenticated attackers to inject malicious JavaScript payloads via crafted POST requests. This results in cross-site scripting that executes in the context of the victim's session, potentially exposing administrative data and allowing unauthorized actions.

The vulnerability allows authenticated attackers to execute arbitrary JavaScript in the context of an administrative user's session. This can lead to unauthorized reading of administrative data and performing actions with the victim's privileges. The CVSS 4.0 base score is 5.1, indicating a medium severity impact with network attack vector, low complexity, and requiring user interaction.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the back-office interface to trusted users only and consider implementing web application firewall (WAF) rules to detect and block suspicious POST requests targeting list filter parameters.