{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"ellite/Wallos","product":"Wallos","source":"CNA: VulnCheck","vendor":"ellite","versions":[{"lessThan":"5.10.3","status":"affected","version":"4.4.0","versionType":"semver"},{"status":"unaffected","version":"5.10.3","versionType":"semver"}]}],"cveId":"CVE-2026-126778","cwes":["CWE-79"],"description":"Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in endpoints/cronjobs/sendnotifications.php that allows registered users to inject scripts via unescaped notification service responses. Attackers can point their Mattermost webhook URL or Web Push endpoint at a controlled server returning JavaScript, which executes in the administrator's session when sendnotifications.php is opened.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0"},{"score":5.4,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794422469623,"publishedAt":1794422469623,"references":[{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/ellite/Wallos/commit/693d8676f3e5b0c85e120fc5958ccb82f37ee89c"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/ellite/Wallos/releases/tag/v5.10.3"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/ellite/Wallos/blob/v5.10.2/endpoints/cronjobs/sendnotifications.php#L813-L816"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/ellite/Wallos/blob/v4.4.0/endpoints/cronjobs/sendnotifications.php#L641-L642"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/wallos-4.4.0-before-5.10.3-stored-xss-via-sendnotifications-php"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/ellite/Wallos/commit/693d8676f3e5b0c85e120fc5958ccb82f37ee89c"}],"revision":"01f6d0350c8e669be1071655818fecb6cf00b7a0e2c6221b845217209f5ab0b6","sources":[{"modifiedAt":1794422469623,"name":"CNA: VulnCheck","retrievedAt":1794424136775,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126778"}],"ssvc":null,"status":"published","title":"Wallos 4.4.0 before 5.10.3 Stored XSS via sendnotifications.php","updatedAt":1794424136775}