Priority HIGH 75
Wallos is an open-source, self-hostable personal subscription tracker.
ellite
Records32All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high17CVSS 7.0–8.9
Exploited now
ellite records in CISA KEVNo ellite vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
16 records in Wallos · all components
Priority HIGH 73
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2024-19429 CVE-2024-29320 · GHSA-r74q-h5x3-cq55
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
Priority HIGH 68
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
Priority HIGH 67
Wallos is an open-source, self-hostable personal subscription tracker.
Priority HIGH 67
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2026-25814 CVE-2026-33417
Wallos: Password Reset Tokens Never Expire
Priority MEDIUM 64
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2026-25798 CVE-2026-33401
Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php
Priority MEDIUM 64
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2026-23670 CVE-2026-30841
Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php
Priority MEDIUM 64
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2024-37875 CVE-2024-57386 · GHSA-8x2p-6xj8-59hx
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute…
Priority MEDIUM 60
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
TI-2026-25797 CVE-2026-33400
Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
Priority MEDIUM 58
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2024-15131 CVE-2024-22776 · GHSA-xq2h-vm9v-fgph
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields…
Priority MEDIUM 55
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields.
TI-2026-23671 CVE-2026-30842
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
Priority MEDIUM 53
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2024-36821 CVE-2024-55372 · GHSA-fqxf-49hh-94mj
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which…
Priority MEDIUM 50
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file.
TI-2024-36820 CVE-2024-55371 · GHSA-mp2g-3625-m5pp
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which…
Priority MEDIUM 50
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file.
Priority MEDIUM 44
Wallos is an open-source, self-hostable personal subscription tracker.
TI-2026-23668 CVE-2026-30839
Wallos: SSRF via webhook test endpoint
Priority LOW 24
Wallos is an open-source, self-hostable personal subscription tracker.