Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-30841 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly in… https://www.cve.org/CVERecord?id=CVE-2026-30841
Post summary
The post highlights that Wallos's passwordreset.php exposed GET parameters prior to version 4.6.2, offering technical details of CVE‑2026‑30841 without mentioning exploits, patches, or PoC.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30841 - Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php Intel Report: https://ift.tt/rfzg1aT
Post summary
Alert announces a reflected XSS vulnerability in Wallos' password reset page, providing only technical details and a link to an intel report, but no PoC, exploit code, or patch information.
CVE-2026-30841 Reflected XSS Vulnerability in Wallos Subscription Tracker Before 4.6.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30841
Post summary
A reflected XSS vulnerability (CVE-2026-30841) has been disclosed for Wallos Subscription Tracker versions prior to 4.6.2, but no active exploitation, patch, or PoC details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wallosapp | wallos | - | - | - |