Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Wallos — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in Wallos, with AI-generated Chinese analysis, references, and POCs.

Vendor: ellite

CVE IDTitleCVSSSeverityPublished
CVE-2026-41689 Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services CWE-863 6.0 Medium2026-05-07
CVE-2026-41688 Incomplete fix for CVE-2026-33399: SSRF in Wallos CWE-918 7.7 High2026-05-07
CVE-2026-41687 Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks CWE-918 4.3 Medium2026-05-07
CVE-2026-33417 Wallos: Password Reset Tokens Never Expire CWE-613 6.5 Medium2026-03-24
CVE-2026-33401 Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php CWE-918 8.1 -2026-03-24
CVE-2026-33400 Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint CWE-79 5.4 Medium2026-03-24
CVE-2026-33399 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 CWE-918 7.7 High2026-03-24
CVE-2026-33407 Wallos: SSRF via HTTP Proxy Environment Variable CWE-918 8.2 -2026-03-24
CVE-2026-30842 Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars CWE-862 4.3 Medium2026-03-07
CVE-2026-30841 Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php CWE-79 6.1 -2026-03-07
CVE-2026-30840 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CWE-918 9.8 -2026-03-07
CVE-2026-30839 Wallos: SSRF via webhook test endpoint CWE-918 6.5 -2026-03-07
CVE-2026-30828 Wallos: SSRF via url parameter leading to File Traversal CWE-29 7.5 -2026-03-07
CVE-2026-27479 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch CWE-918 7.7 High2026-02-21

All 14 known CVE vulnerabilities affecting Wallos with full Chinese analysis, references, and POCs where available.