279 matches found
PT-2025-16885 · Wallos · Wallos
Name of the Vulnerable Software and Affected Versions: Wallos versions 2.38.2 and earlier Description: The issue allows authenticated users to upload malicious files to the server through the restore backup function by uploading a ZIP file. The contents of the ZIP file are extracted on the server...
CVE-2024-55372
Wallos versions 2.38.2 and earlier are vulnerable to a file upload flaw in the restore database function. This vulnerability allows unauthenticated users to upload a ZIP file , which the server then extracts. An attacker can exploit this to upload malicious files and install a web shell , leading...
CVE-2024-55372
Wallos =2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious fil...
CVE-2024-55371
Wallos = 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker being an administrator is not...
CVE-2024-55371
Wallos = 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker being an administrator is not...
PT-2025-16886
Name of the Vulnerable Software and Affected Versions Wallos versions =2.38.2 Description The issue concerns a file upload vulnerability in the restore database function. This vulnerability allows unauthenticated users to restore a database by uploading a ZIP file, the contents of which are...
CVE-2024-55371
The open-source personal subscription tracker Wallos versions 2.38.2 and earlier is vulnerable to a file upload flaw within the restore backup function. This vulnerability allows authenticated users (administrator privileges are not required) to upload a ZIP file that the server extracts automati...
CVE-2024-55372
Wallos =2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious fil...
CVE-2024-55371
Wallos = 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker being an administrator is not...
CVE-2024-55371: External Control of File Name or Path
Wallos = 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker being an administrator is not...
The vulnerability of the Wallos financial management web application, related to the lack of protective measures for the website structure, allows a hacker to execute arbitrary code.
The vulnerability of the Wallos financial management web application is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2024-57386
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
CVE-2024-57386
CVE-2024-57386 affects Wallos v2.41.0. A Cross Site Scripting vulnerability in the profile picture function allows a remote attacker to execute arbitrary code. The issue is documented across multiple sources (NVD, Red Hat, OSV, CNNVD, etc.). Exploitation vectors are not detailed beyond the profil...
CVE-2024-57386
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
CVE-2024-57386: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
CVE-2024-57386
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
PT-2025-3436 · Wallos · Wallos
Name of the Vulnerable Software and Affected Versions: Wallos version 2.41.0 Description: The issue allows a remote attacker to execute arbitrary code via the profile picture function. This is a result of a Cross Site Scripting vulnerability. Recommendations: For Wallos version 2.41.0, consider...
Wallos 跨站脚本漏洞
Wallos is an open source personal subscription tracker by the individual developer Miguel Ribeiro. A security vulnerability exists in Wallos version v.2.41.0. An attacker exploiting this vulnerability could execute arbitrary code via the profile picture feature...