What’s Vulnerable › Products

ellite Wallos vulnerabilities

32 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.

Check whether your ellite Wallos version is affected

Latest ellite Wallos vulnerabilities

• CVE-2026-77353 — Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export (CVSS 4.6)
• CVE-2026-77352 — Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) (CVSS 4.3)
• CVE-2026-77351 — Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings (CVSS 3.5)
• CVE-2026-77348 — Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php` (CVSS 8.2)
• CVE-2026-61641 — Wallos: OIDC account takeover via email-based account linking without `email_verified` check (CVSS 8.1)
• CVE-2026-61640 — Wallos: SSRF via OIDC Token/UserInfo URL Configuration (CVSS 8.5)
• CVE-2026-61639 — Wallos: Zip Slip path traversal in database restore writes files to webroot (CVSS 8.5)
• CVE-2026-61638 — Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port (CVSS 8.2)
• CVE-2026-54600 — Wallos: Unauthenticated database replacement via import endpoint on fresh install (CVSS 8.2)
• CVE-2026-54599 — Wallos: OIDC state parameter never validated — login CSRF / account takeover (CVSS 7.5)
• CVE-2026-54598 — Missing Authentication for Critical Function in wallos (CVSS 7.5)
• CVE-2026-50199 — Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh (CVSS 4.3)
• CVE-2026-50198 — Wallos: Cross-user subscription cost inference via replacement_subscription_id (CVSS 4.3)
• CVE-2026-41689 — Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services (CVSS 6.0)
• CVE-2026-41688 — Incomplete fix for CVE-2026-33399: SSRF in Wallos (CVSS 7.7)
• CVE-2026-41687 — Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks (CVSS 4.3)
• CVE-2026-33417 — Wallos: Password Reset Tokens Never Expire (CVSS 7.1)
• CVE-2026-33407 — Wallos: SSRF via HTTP Proxy Environment Variable (CVSS 9.1)
• CVE-2026-33401 — Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php (CVSS 6.5)
• CVE-2026-33400 — Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint (CVSS 5.4)
• CVE-2026-33399 — Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 (CVSS 7.7)
• CVE-2026-30842 — Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars (CVSS 4.3)
• CVE-2026-30841 — Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php (CVSS 6.1)
• CVE-2026-30840 — Wallos: Server-Side Request Forgery (SSRF) in Notification Testers (CVSS 8.8)
• CVE-2026-30839 — Wallos: SSRF via webhook test endpoint (CVSS 4.3)