PT-2026-27469 · Wallos · Wallos

Tunelko · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33400

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.7.0

Description A stored cross-site scripting (XSS) flaw exists in the payment method rename endpoint. This allows any authenticated user to inject arbitrary JavaScript code that will execute when other users access the Settings, Subscriptions, or Statistics pages. The wallos login authentication cookie does not have the HttpOnly flag set, which enables full session hijacking when combined with the XSS flaw. The API endpoint affected is the payment method rename endpoint. The vulnerable component is the functionality that handles renaming payment methods.

Recommendations Update to version 4.7.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33400

GHSA-P6V5-227F-F3FV

Produtos afetados

Wallos

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33400.json · Exploit
• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef · Correção
• https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33400 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33400 · Nota de Segurança