wallosapp records

16 published records for vendor wallosapp.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 3
With a fix record: 68.8%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-55372No exploit	Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by wallosapp · wallos · CWE-73 pre-auth RCE Path traversal	Critical9.8	—	0.6%	Apr 16, 2025
39Monitor	CVE-2024-55371No exploit	Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uplowallosapp · wallos · CWE-73 pre-auth RCE Path traversal	Critical9.8	—	0.6%	Apr 16, 2025
35Monitor	CVE-2026-30840No exploit	Wallos: Server-Side Request Forgery (SSRF) in Notification Testerswallosapp · wallos · CWE-295 SSRF Weak crypto	High8.8	—	0.5%	Mar 7, 2026
34Monitor	CVE-2026-30828No exploit	Wallos: SSRF via url parameter leading to File Traversalwallosapp · wallos · CWE-22 Pre-auth SSRF Path traversal	High8.7	—	0.5%	Mar 7, 2026
33Monitor	CVE-2026-33407No exploit	Wallos: SSRF via HTTP Proxy Environment Variablewallosapp · wallos · CWE-918 Pre-auth SSRF	High8.3	—	0.5%	Mar 24, 2026
32Monitor	CVE-2024-29320No exploit	Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.wallosapp · wallos · CWE-89 SQL injection	High8.1	—	0.7%	Apr 30, 2024
30Monitor	CVE-2026-27479No exploit	Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetchwallosapp · wallos · CWE-918 SSRF	High7.7	—	0.4%	Feb 21, 2026
30Monitor	CVE-2026-33399No exploit	Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840wallosapp · wallos · CWE-918 SSRF	High7.7	—	0.4%	Mar 24, 2026
28Monitor	CVE-2026-33401No exploit	Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.phpwallosapp · wallos · CWE-918 SSRF	High7.1	—	0.4%	Mar 24, 2026
28Monitor	CVE-2026-33417No exploit	Wallos: Password Reset Tokens Never Expirewallosapp · wallos · CWE-613 Pre-auth	High7.1	—	0.3%	Mar 24, 2026
27Monitor	CVE-2026-30841No exploit	Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.phpwallosapp · wallos · CWE-79 Pre-auth XSS	Medium6.9	—	0.3%	Mar 7, 2026
24Monitor	CVE-2024-57386No exploit	Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.wallosapp · wallos · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.5%	Jan 23, 2025
21Monitor	CVE-2026-30839No exploit	Wallos: SSRF via webhook test endpointwallosapp · wallos · CWE-918 SSRF	Medium5.3	—	0.4%	Mar 7, 2026
21Monitor	CVE-2026-33400No exploit	Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpointwallosapp · wallos · CWE-79 XSS	Medium5.4	—	0.3%	Mar 24, 2026
18Monitor	CVE-2024-22776No exploit	Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring swallosapp · wallos · CWE-79 Pre-auth XSS	Medium4.7	—	0.5%	Feb 23, 2024
17Monitor	CVE-2026-30842No exploit	Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatarswallosapp · wallos · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.3%	Mar 7, 2026

CVE-2024-55372
39Monitor
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Path traversal
wallosapp · wallosApr 16, 2025
CVE-2024-55371
39Monitor
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uplo
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Path traversal
wallosapp · wallosApr 16, 2025
CVE-2026-30840
35Monitor
Wallos: Server-Side Request Forgery (SSRF) in Notification Testers
HighCVSS 8.8No exploitEPSS 1%
- SSRF
- Weak crypto
wallosapp · wallosMar 7, 2026
CVE-2026-30828
34Monitor
Wallos: SSRF via url parameter leading to File Traversal
HighCVSS 8.7No exploitEPSS 1%
wallosapp · wallosMar 7, 2026
CVE-2026-33407
33Monitor
Wallos: SSRF via HTTP Proxy Environment Variable
HighCVSS 8.3No exploitEPSS 1%
- Pre-auth
- SSRF
wallosapp · wallosMar 24, 2026
CVE-2024-29320
32Monitor
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
HighCVSS 8.1No exploitEPSS 1%
- SQL injection
wallosapp · wallosApr 30, 2024
CVE-2026-27479
30Monitor
Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch
HighCVSS 7.7No exploitEPSS 0%
- SSRF
wallosapp · wallosFeb 21, 2026
CVE-2026-33399
30Monitor
Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840
HighCVSS 7.7No exploitEPSS 0%
- SSRF
wallosapp · wallosMar 24, 2026
CVE-2026-33401
28Monitor
Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php
HighCVSS 7.1No exploitEPSS 0%
- SSRF
wallosapp · wallosMar 24, 2026
CVE-2026-33417
28Monitor
Wallos: Password Reset Tokens Never Expire
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
wallosapp · wallosMar 24, 2026
CVE-2026-30841
27Monitor
Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- XSS
wallosapp · wallosMar 7, 2026
CVE-2024-57386
24Monitor
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
wallosapp · wallosJan 23, 2025
CVE-2026-30839
21Monitor
Wallos: SSRF via webhook test endpoint
MediumCVSS 5.3No exploitEPSS 0%
- SSRF
wallosapp · wallosMar 7, 2026
CVE-2026-33400
21Monitor
Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
MediumCVSS 5.4No exploitEPSS 0%
- XSS
wallosapp · wallosMar 24, 2026
CVE-2024-22776
18Monitor
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring s
MediumCVSS 4.7No exploitEPSS 0%
- Pre-auth
- XSS
wallosapp · wallosFeb 23, 2024
CVE-2026-30842
17Monitor
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
wallosapp · wallosMar 7, 2026