Halo
by Halo Dev
Source repositories
CVEs (47)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-44593 | Med | 0.40 | 6.1 | 0.00 | Sep 9, 2025 | Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13 | ||
| CVE-2025-51857 | Med | 0.40 | 6.1 | 0.00 | Aug 5, 2025 | The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks. | ||
| CVE-2023-33528 | Med | 0.40 | 6.1 | 0.00 | Mar 28, 2024 | halo v1.6.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2020-18979 | Med | 0.40 | 6.1 | 0.01 | Jul 12, 2021 | Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter. | ||
| CVE-2020-21345 | Med | 0.40 | 6.1 | 0.01 | May 20, 2021 | Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code. | ||
| CVE-2018-11012 | Med | 0.40 | 6.1 | 0.01 | May 12, 2018 | ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java. | ||
| CVE-2018-11011 | Med | 0.40 | 6.1 | 0.01 | May 12, 2018 | ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java. | ||
| CVE-2025-60898 | Med | 0.38 | 5.8 | 0.00 | Oct 29, 2025 | An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a… | ||
| CVE-2026-36756 | Med | 0.35 | 5.4 | 0.00 | Apr 30, 2026 | A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request. | ||
| CVE-2021-43659 | Med | 0.35 | 5.4 | 0.01 | Mar 24, 2022 | In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability. | ||
| CVE-2022-22124 | Med | 0.35 | 5.4 | 0.01 | Jan 13, 2022 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser. | ||
| CVE-2022-22123 | Med | 0.35 | 5.4 | 0.01 | Jan 13, 2022 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server. | ||
| CVE-2020-19037 | Med | 0.35 | 5.3 | 0.01 | Jul 12, 2021 | Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. | ||
| CVE-2020-18982 | Med | 0.35 | 5.4 | 0.01 | Jul 12, 2021 | Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl. | ||
| CVE-2020-19007 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser. | ||
| CVE-2019-16890 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2019 | Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments. | ||
| CVE-2023-27164 | Med | 0.31 | 4.8 | 0.01 | Mar 10, 2023 | An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. | ||
| CVE-2022-28074 | Med | 0.31 | 4.8 | 0.00 | Apr 22, 2022 | Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools. | ||
| CVE-2022-22125 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2022 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server. | ||
| CVE-2026-36757 | Med | 0.28 | 4.3 | 0.00 | Apr 30, 2026 | A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request. |
- risk 0.40cvss 6.1epss 0.00
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13
- risk 0.40cvss 6.1epss 0.00
The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.
- risk 0.40cvss 6.1epss 0.00
halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code.
- risk 0.40cvss 6.1epss 0.01
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
- risk 0.40cvss 6.1epss 0.01
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
- risk 0.38cvss 5.8epss 0.00
An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a…
- risk 0.35cvss 5.4epss 0.00
A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- risk 0.35cvss 5.4epss 0.01
In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability.
- risk 0.35cvss 5.4epss 0.01
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
- risk 0.35cvss 5.4epss 0.01
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server.
- risk 0.35cvss 5.3epss 0.01
Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies.
- risk 0.35cvss 5.4epss 0.01
Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
- risk 0.35cvss 5.4epss 0.01
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser.
- risk 0.35cvss 5.4epss 0.01
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.
- risk 0.31cvss 4.8epss 0.01
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.
- risk 0.31cvss 4.8epss 0.00
Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.
- risk 0.31cvss 4.8epss 0.01
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server.
- risk 0.28cvss 4.3epss 0.00
A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
Page 2 of 3