Read the docs
TI-2026-23670 Aliases CVE-2026-30841

Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php

Priority MEDIUM 64CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Wallos (ellite): 4.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elliteWallosbefore 4.6.24.6.2Patch availableCNA
  • Wallos Vendorellite Affected before 4.6.2 Fixed in 4.6.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*before 4.6.2Vulnerableellite
  • cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:* Versions before 4.6.2 Vulnerable ·ellite

Remediation

  • Fix · CNA Wallos (ellite) Fixed in 4.6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30841

References

Exploit 1

Patch 1

Other 1

  • TI-2026-25804 Wallos: SSRF via HTTP Proxy Environment Variable CVSS 4.0HIGH 8.3
  • TI-2026-23669 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CVSS 3.0HIGH 8.8
  • TI-2024-19429 Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. CVSS 3.1HIGH 8.1
  • TI-2026-25796 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 CVSS 3.1HIGH 7.7
  • TI-2026-21886 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch CVSS 3.1HIGH 7.7
  • TI-2026-25814 Wallos: Password Reset Tokens Never Expire CVSS 3.1HIGH 7.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences