diff --git a/app/services/qualys_tags_service.py b/app/services/qualys_tags_service.py
index f292fd4..26031a5 100644
--- a/app/services/qualys_tags_service.py
+++ b/app/services/qualys_tags_service.py
@@ -44,10 +44,18 @@ def _qualys_post(db, endpoint, payload, timeout=60):
 
 
 def _parse_xml_text(text_block, tag):
-    """Extrait <tag>valeur</tag> (premier match)."""
-    import re
+    """Extrait <tag>valeur</tag>, unescape entites (boucle si double-escape Qualys)."""
+    import re, html
     m = re.search(f"<{tag}>(.*?)</{tag}>", text_block, re.DOTALL)
-    return m.group(1).strip() if m else ""
+    if not m:
+        return ""
+    v = m.group(1).strip()
+    for _ in range(3):
+        u = html.unescape(v)
+        if u == v:
+            break
+        v = u
+    return v
 
 
 def list_qualys_tags(db):