Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')