QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub