ellite Wallos vulnerabilities
28 published CVEs name ellite Wallos among the affected products.
- 28Published CVEs28 of them scored
- 28Last 12 monthspublished in the last year
- 0Critical15 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126778
Wallos 4.4.0 before 5.10.3 Stored XSS via sendnotifications.php
ellite · Wallos
Medium5.1 - CVE-2026-77353
Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
ellite · Wallos
Medium4.6 - CVE-2026-77352
Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
ellite · Wallos
Medium4.3 - CVE-2026-77348
Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
ellite · Wallos
High8.2 - CVE-2026-77351
Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
ellite · Wallos
Low3.5 - CVE-2026-61641
Wallos: OIDC account takeover via email-based account linking without `email_verified` check
ellite · Wallos
High8.1 - CVE-2026-61640
Wallos: SSRF via OIDC Token/UserInfo URL Configuration
ellite · Wallos
High8.5 - CVE-2026-61639
Wallos: Zip Slip path traversal in database restore writes files to webroot
ellite · Wallos
High8.5 - CVE-2026-61638
Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
ellite · Wallos
High8.2 - CVE-2026-54600
Wallos: Unauthenticated database replacement via import endpoint on fresh install
ellite · Wallos
High8.2