CVE-2024-22776

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-02-23 · updated 2026-06-17
Weakness: CWE-79

Description

Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields.

Affected products

ellite Wallos: from 0.9 before 1.2.3 — fixed in 1.2.3

How to fix

Upgrade to a fixed version: ellite Wallos 1.2.3. Check the vendor advisory for mitigations.

References

https://github.com/ellite/Wallos
https://webity-luescher.notion.site/webity-luescher/Wallos-v0-9-to-v1-2-2-CVE-2024-22776-Stored-XSS-Vulnerability-in-all-text-based-input-fields-6622fb4cfbe0430aa0b1d4b3edcb67b0
https://github.com/ellite/Wallos
https://webity-luescher.notion.site/webity-luescher/Wallos-v0-9-to-v1-2-2-CVE-2024-22776-Stored-XSS-Vulnerability-in-all-text-based-input-fields-6622fb4cfbe0430aa0b1d4b3edcb67b0

Get alerted when CVE-2024-22776 or the next vulnerability affects your stack