Ellite vulnerabilities
27 CVEs and advisories name Ellite as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-77353Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
- CVE-2026-77352Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
- CVE-2026-77348Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
- CVE-2026-77351Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
- CVE-2026-61641Wallos: OIDC account takeover via email-based account linking without `email_verified` check
- CVE-2026-61640Wallos: SSRF via OIDC Token/UserInfo URL Configuration
- CVE-2026-61639Wallos: Zip Slip path traversal in database restore writes files to webroot
- CVE-2026-61638Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
- CVE-2026-54600Wallos: Unauthenticated database replacement via import endpoint on fresh install
- CVE-2026-54599Wallos: OIDC state parameter never validated — login CSRF / account takeover
- CVE-2026-54598Missing Authentication for Critical Function in wallos
- CVE-2026-50199Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh
- CVE-2026-50198Wallos: Cross-user subscription cost inference via replacement_subscription_id
- CVE-2026-41689Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services
- CVE-2026-41688Incomplete fix for CVE-2026-33399: SSRF in Wallos
- CVE-2026-41687Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks
- CVE-2026-33417Wallos: Password Reset Tokens Never Expire
- CVE-2026-33401Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php
- CVE-2026-33400Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
- CVE-2026-33399Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840
- CVE-2026-33407Wallos: SSRF via HTTP Proxy Environment Variable
- CVE-2026-30842Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
- CVE-2026-30841Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php
- CVE-2026-30840Wallos: Server-Side Request Forgery (SSRF) in Notification Testers
- CVE-2026-30839Wallos: SSRF via webhook test endpoint
- CVE-2026-30828Wallos: SSRF via url parameter leading to File Traversal
- CVE-2026-27479Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch