https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-28T10:24:28.917230+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116746 fkie_cve-2026-116746 2026-10-28T10:24:28.936773+00:00

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.

 https://db.gcve.eu/vuln/ghsa-r73j-mrwx-7crw GHSA-r73j-mrwx-7crw 2026-10-28T10:24:28.936867+00:00

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.