Threats affecting pkg:github/Wallos

Wallos versions 4.4.0 up to but not including 5.10.3 contain a stored cross-site scripting (XSS) vulnerability in the sendnotifications.php endpoint. This flaw allows registered users to inject malicious JavaScript via unescaped notification service responses. An attacker can exploit this by directing a Mattermost webhook URL or Web Push endpoint to a server they control, causing script execution in an administrator's session when the vulnerable page is accessed. The vulnerability is fixed in version 5.10.3.