Is CVE-2025-60535 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60535 being exploited in the wild.

How severe is CVE-2025-60535?

High severity, with a CVSS score of 7.3, published 14 October 2025.

Which products and versions are affected?

Ellite Wallos 4.1.1 and earlier.

Is there a fix for CVE-2025-60535?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60535 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-60535?

Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60535: Wallos CSRF in currency and category endpoints

CVE-2025-60535 · Severity: high · CVSS 7.3 · Published 2025-10-14

Wallos, an open-source personal subscription and expense tracker, contains a security flaw that could allow an attacker to perform unauthorized actions on behalf of a user. By tricking a logged-in user into clicking a malicious link or visiting a compromised website, an attacker could delete financial categories or currency settings without the user's consent. This could lead to data loss and disruption of the user's budget management and expense tracking.

Technologies: Ellite Wallos. Vendors: Ellite.

Quick answers

Is CVE-2025-60535 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60535 being exploited in the wild.
How severe is CVE-2025-60535?: High severity, with a CVSS score of 7.3, published 14 October 2025.
Which products and versions are affected?: Ellite Wallos 4.1.1 and earlier.
Is there a fix for CVE-2025-60535?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60535 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-60535?: Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Currencies and Categories management components of Wallos, specifically within the '/endpoints/currency/currency.php' and '/endpoints/categories/category.php' endpoints. The application fails to implement proper CSRF protections (such as anti-CSRF tokens) for sensitive state-changing operations performed via GET requests. An attacker can exploit this by crafting a malicious URL or HTML page that, when visited by an authenticated user, triggers the 'delete' action for specific category or currency IDs. This allows for unauthorized data modification or deletion without the user's knowledge. The vulnerability is confirmed in version 4.1.1 and earlier.

Affected products

ellite Wallos 4.1.1 and earlier

Timeline

2025-10-14: advisory: CVE-2025-60535 published by MITRE/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.