Skip to content
Wallosapp Wallos vulnerabilities
-
ellite wallos
Wallos: Password Reset Tokens Never Expire
CVE-2026-33417
6.5 Medium
-
ellite wallos
Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php
CVE-2026-33401
7.1 High
-
ellite wallos
Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
CVE-2026-33400
5.4 Medium
-
ellite wallos
Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840
CVE-2026-33399
7.7 High
-
ellite wallos
Wallos: SSRF via HTTP Proxy Environment Variable
CVE-2026-33407
8.3 High
-
ellite wallos
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
CVE-2026-30842
4.3 Medium
-
ellite wallos
Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php
CVE-2026-30841
6.9 Medium
-
ellite wallos
Wallos: Server-Side Request Forgery (SSRF) in Notification Testers
CVE-2026-30840
8.8 High
-
ellite wallos
Wallos: SSRF via webhook test endpoint
CVE-2026-30839
5.3 Medium
-
ellite wallos
Wallos: SSRF via url parameter leading to File Traversal
CVE-2026-30828
8.7 High
-
ellite wallos
Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch
CVE-2026-27479
7.7 High
-
wallosapp wallos
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows...
CVE-2024-55372
9.8 Critical
-
wallosapp wallos
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows...
CVE-2024-55371
9.8 Critical
-
wallosapp wallos
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute...
CVE-2024-57386
6.1 Medium
-
ellite wallos
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to ...
CVE-2024-29320
8.1 High
-
ellite wallos
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without...
CVE-2024-22776
4.7 Medium