VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Aug 26, 2020· Updated Jun 17, 2026

CVE-2020-19007

CVE-2020-19007

Description

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser.

Affected products

3
  • Halo Dev/Halo2 versions
    cpe:2.3:a:halo:halo:1.2.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:halo:halo:1.2.0:*:*:*:*:*:*:*
    • (no CPE)range: <1.2.0
  • Halo/blogdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.