Wallos
by Wallos
CVEs (5)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-55372 | Cri | 0.64 | 9.8 | 0.01 | Apr 16, 2025 | Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to… | ||
| CVE-2024-55371 | Cri | 0.64 | 9.8 | 0.01 | Apr 16, 2025 | Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an… | ||
| CVE-2024-29320 | Hig | 0.53 | 8.1 | 0.01 | Apr 30, 2024 | Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. | ||
| CVE-2024-57386 | Med | 0.40 | 6.1 | 0.00 | Jan 23, 2025 | Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function. | ||
| CVE-2024-22776 | Med | 0.31 | 4.7 | 0.00 | Feb 23, 2024 | Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields. |
- risk 0.64cvss 9.8epss 0.01
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to…
- risk 0.64cvss 9.8epss 0.01
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an…
- risk 0.53cvss 8.1epss 0.01
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
- risk 0.31cvss 4.7epss 0.00
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields.