CVE-2026-30841

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.6.2

Description Wallos is a self-hostable personal subscription tracker. Prior to version 4.6.2, the passwordreset.php script outputs the token and email parameters directly into HTML input value attributes without proper sanitization. Specifically, the script uses and without calling htmlspecialchars(). This allows for reflected Cross-Site Scripting (XSS) by breaking out of the attribute context. The token and email parameters are vulnerable.

Recommendations Update to version 4.6.2 or later.