Skip to content
Halo vulnerabilities
Newest
-
halo
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a...
CVE-2025-70886
Public exploit
7.5 High
-
halo
Halo Configuration actuator information disclosure
CVE-2025-15141
2.3 Low
-
halo
Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
CVE-2025-44595
6.1 Medium
-
halo
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api...
CVE-2025-44594
9.1 Critical
-
halo
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as ...
CVE-2025-44593
6.1 Medium
-
halo
Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
CVE-2024-56156
5.5 Medium
-
halo
Halo's editor has a stored XSS vulnerability
CVE-2024-43793
6.3 Medium
-
halo
Halo's editor has a stored Cross-Site Scripting vulnerability
CVE-2024-43792
6.3 Medium
-
halo
halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-33528
6.1 Medium
-
halo
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary...
CVE-2023-27164
4.8 Medium
-
halo
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template...
CVE-2022-32995
EPSS 17.6%
9.8 Critical
-
halo
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the...
CVE-2022-32994
EPSS 18.5%
9.8 Critical
-
halo
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the...
CVE-2022-26619
7.5 High
-
halo
In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as...
CVE-2021-43659
5.4 Medium
-
halo
Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag
CVE-2022-22125
4.8 Medium
-
halo
File Deletion vulnerability in Halo 0.4.3 via delBackup.
CVE-2020-19038
9.1 Critical
-
halo
Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass...
CVE-2020-19037
5.3 Medium
-
halo
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server...
CVE-2020-23079
7.5 High
-
halo
Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
CVE-2020-18982
5.4 Medium
-
halo
Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.
CVE-2020-18980
9.8 Critical
-
halo
Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.
CVE-2020-18979
6.1 Medium
-
halo
Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage...
CVE-2020-21345
6.1 Medium
-
halo
There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the...
CVE-2020-21527
7.7 High
-
halo
An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the...
CVE-2020-21526
9.8 Critical
-
halo
Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1...
CVE-2020-21525
7.5 High
-
halo
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing...
CVE-2020-21524
9.1 Critical
-
halo
A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme...
CVE-2020-21523
9.8 Critical
-
halo
An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the...
CVE-2020-21522
9.8 Critical
-
halo
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments....
CVE-2020-19007
5.4 Medium
-
halo
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because...
CVE-2019-19999
7.2 High
-
halo
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.
CVE-2019-16890
5.4 Medium
-
halo
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login...
CVE-2018-11012
6.1 Medium
-
halo
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
CVE-2018-11011
6.1 Medium