Threats Tagged 'ghsa-crrq-mjw6-39qp'

QloApps versions up to 1.7.0 contain a cross-site scripting (XSS) vulnerability in the back-office list filter functionality. The application improperly escapes POST parameters rendered into HTML input value attributes, allowing authenticated users to submit crafted requests that execute arbitrary JavaScript. This can lead to unauthorized reading of administrative data and performing actions within the victim's session.