PT-2026-27469 · Wallos · Wallos

Tunelko · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33400

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.7.0

Description A stored cross-site scripting (XSS) flaw exists in the payment method rename endpoint. This allows any authenticated user to inject arbitrary JavaScript code that will execute when other users access the Settings, Subscriptions, or Statistics pages. The wallos login authentication cookie does not have the HttpOnly flag set, which enables full session hijacking when combined with the XSS flaw. The API endpoint affected is the payment method rename endpoint. The vulnerable component is the functionality that handles renaming payment methods.

Recommendations Update to version 4.7.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33400

GHSA-P6V5-227F-F3FV

Affected Products

Wallos

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33400.json · Exploit
• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef · Patch
• https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33400 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33400 · Security Note