4.8
MediumCVSS 3.1 · from VulnCheck
CVE-2026-25558
QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
QloApps · Cross-site scripting · CWE-79AffectedQloApps
FixNo fix listed yet.
PublishedJun 8, 14:01 · VulnCheck
ScoredJun 8 · 4.8 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inQloAppsup to 1.7.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known