TI-2024-15131 Aliases CVE-2024-22776 GHSA-xq2h-vm9v-fgph

Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields…

MEDIUM 55CWE-79Published 2024-02-23 · Updated 2024-08-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00474 41st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wallosapp:wallos::::::::	0.9 to before 1.2.3	Vulnerable	ellite

cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:* Versions 0.9 to before 1.2.3 Vulnerable ·ellite

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-22776
2026-10-03 Alias added: GHSA-xq2h-vm9v-fgph

References

Exploit 1

https://webity-luescher.notion.site/webity-luescher/Wallos-v0-9-to-v1-2-2-CVE-2024-22776-Stored-XSS-Vulnerability-in-all-text-based-input-fields-6622fb4cfbe0430aa0b1d4b3edcb67b0

Other 1

https://github.com/ellite/Wallos

TI-2026-25804 Wallos: SSRF via HTTP Proxy Environment Variable CVSS 4.0HIGH 8.3
TI-2026-23669 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CVSS 3.0HIGH 8.8
TI-2024-19429 Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. CVSS 3.1HIGH 8.1
TI-2026-25796 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 CVSS 3.1HIGH 7.7
TI-2026-21886 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch CVSS 3.1HIGH 7.7
TI-2026-25814 Wallos: Password Reset Tokens Never Expire CVSS 3.1HIGH 7.1

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences