Priority HIGH 78
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00373 · Published 2025-09-09 · No fix listed CWE-918
Priority HIGH 72
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00512 · Published 2026-02-12 · No fix listed CWE-400
Priority HIGH 70
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00374 · Published 2026-09-24 · No fix listed CWE-20
Priority MEDIUM 64
Halo is an open source website building tool.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00325 · Published 2024-09-11 · Fixed in 2.19.0 CWE-79
Priority MEDIUM 61
Halo is an open source website building tool.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00351 · Published 2024-09-02 · Fixed in 2.17.0 CWE-79
Priority MEDIUM 60
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18539 · Published 2022-06-27 · No fix listed CWE-434
Priority MEDIUM 59
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.17629 · Published 2022-06-27 · No fix listed CWE-918
Priority MEDIUM 58
Halo is an open source website building tool.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00413 · Published 2026-06-25 · Fixed in 2.24.3 CWE-22
Priority MEDIUM 57
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.0032 · Published 2026-09-15 · No fix listed CWE-601
Priority MEDIUM 56
A vulnerability was detected in halo-dev halo up to 2.24.2.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00486 · Published 2026-07-18 · No fix listed CWE-22
Priority MEDIUM 56
A vulnerability was identified in halo-dev halo up to 2.24.2.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00537 · Published 2026-07-10 · No fix listed CWE-22
Priority MEDIUM 47
A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02587 · Published 2020-09-30 · No fix listed CWE-74
Priority MEDIUM 46
An Arbitrary file writing vulnerability in halo v1.1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0189 · Published 2020-09-30 · No fix listed CWE-22
Priority MEDIUM 45
A vulnerability was determined in Halo up to 2.21.10.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00253 · Published 2025-12-28 · No fix listed CWE-200
Priority MEDIUM 45
An issue was discovered in halo V1.1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01532 · Published 2020-09-30 · No fix listed CWE-22
Priority MEDIUM 45
Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0146 · Published 2021-07-12 · No fix listed
Priority MEDIUM 42
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security def…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0151 · Published 2020-09-30 · No fix listed CWE-611
Priority MEDIUM 42
File Deletion vulnerability in Halo 0.4.3 via delBackup.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01168 · Published 2021-07-12 · No fix listed CWE-862
Priority LOW 37
A flaw has been found in halo-dev halo up to 2.27.0-beta.1.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00502 · Published 2026-10-26 · No fix listed CWE-22
Priority LOW 37
Halo V1.1.3 is affected by: Arbitrary File reading.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01917 · Published 2020-09-30 · No fix listed CWE-22
Priority LOW 36
There is an Arbitrary file deletion vulnerability in halo v1.1.3.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.01123 · Published 2020-09-30 · No fix listed CWE-22
Priority LOW 35
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00881 · Published 2022-04-05 · No fix listed CWE-434
Priority LOW 35
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01242 · Published 2021-07-12 · No fix listed CWE-918
Priority LOW 35
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01512 · Published 2019-12-26 · No fix listed CWE-918
Priority LOW 29
Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00807 · Published 2021-05-20 · No fix listed CWE-79
Load more
THREATIST.IORead the docs