274 matches found
CVE-2024-55372: External Control of File Name or Path
Wallos =2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious fil...
CVE-2024-55371
Wallos = 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker being an administrator is not...
CVE-2024-55372
Wallos versions 2.38.2 and earlier are vulnerable to a file upload flaw in the restore database function. This vulnerability allows unauthenticated users to upload a ZIP file , which the server then extracts. An attacker can exploit this to upload malicious files and install a web shell , leading...
Wallos 安全漏洞
Wallos is an open source personal subscription tracker by the individual developer Miguel Ribeiro. A security vulnerability exists in Wallos 2.38.2 and earlier versions, which stems from a recovery database feature that allows unauthenticated users to upload malicious files, potentially leading t...
CVE-2024-55372
Wallos =2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious fil...
PT-2025-16885 · Wallos · Wallos
Name of the Vulnerable Software and Affected Versions: Wallos versions 2.38.2 and earlier Description: The issue allows authenticated users to upload malicious files to the server through the restore backup function by uploading a ZIP file. The contents of the ZIP file are extracted on the server...
CVE-2024-55371
Wallos = 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker being an administrator is not...
The vulnerability of the Wallos financial management web application, related to the lack of protective measures for the website structure, allows a hacker to execute arbitrary code.
The vulnerability of the Wallos financial management web application is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2024-57386
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
CVE-2024-57386
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
Wallos 跨站脚本漏洞
Wallos is an open source personal subscription tracker by the individual developer Miguel Ribeiro. A security vulnerability exists in Wallos version v.2.41.0. An attacker exploiting this vulnerability could execute arbitrary code via the profile picture feature...
CVE-2024-57386
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
PT-2025-3436 · Wallos · Wallos
Name of the Vulnerable Software and Affected Versions: Wallos version 2.41.0 Description: The issue allows a remote attacker to execute arbitrary code via the profile picture function. This is a result of a Cross Site Scripting vulnerability. Recommendations: For Wallos version 2.41.0, consider...
CVE-2024-57386
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
CVE-2024-57386: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function...
CVE-2024-57386
CVE-2024-57386 affects Wallos v2.41.0. A Cross Site Scripting vulnerability in the profile picture function allows a remote attacker to execute arbitrary code. The issue is documented across multiple sources (NVD, Red Hat, OSV, CNNVD, etc.). Exploitation vectors are not detailed beyond the profil...
CVE-2024-29320
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...
CVE-2024-29320: Improper Neutralization of Special Elements used in an SQL Command
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...
CVE-2024-29320
Wallos versions prior to 1.15.3 are vulnerable to an SQL Injection vulnerability. The flaw originates from the improper neutralization of special elements in the category and payment parameters within the /subscriptions/get.php API endpoint. This could allow an attacker to execute unauthorized SQ...