Priority HIGH 78
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00373 · Published 2025-09-09 · No fix listed CWE-918
Priority HIGH 72
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00524 · Published 2026-02-12 · No fix listed CWE-400
Priority MEDIUM 64
Halo is an open source website building tool.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00325 · Published 2024-09-11 · Fixed in 2.19.0 CWE-79
Priority MEDIUM 61
Halo is an open source website building tool.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00351 · Published 2024-09-02 · Fixed in 2.17.0 CWE-79
Priority MEDIUM 60
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18539 · Published 2022-06-27 · No fix listed CWE-434
Priority MEDIUM 59
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.17629 · Published 2022-06-27 · No fix listed CWE-918
Priority MEDIUM 47
A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02587 · Published 2020-09-30 · No fix listed CWE-74
Priority MEDIUM 46
An Arbitrary file writing vulnerability in halo v1.1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0189 · Published 2020-09-30 · No fix listed CWE-22
Priority MEDIUM 45
A vulnerability was determined in Halo up to 2.21.10.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00253 · Published 2025-12-28 · No fix listed CWE-200
Priority MEDIUM 45
An issue was discovered in halo V1.1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01532 · Published 2020-09-30 · No fix listed CWE-22
Priority MEDIUM 45
Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0146 · Published 2021-07-12 · No fix listed
Priority MEDIUM 42
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security def…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0151 · Published 2020-09-30 · No fix listed CWE-611
Priority MEDIUM 42
File Deletion vulnerability in Halo 0.4.3 via delBackup.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01168 · Published 2021-07-12 · No fix listed CWE-862
Priority LOW 37
Halo V1.1.3 is affected by: Arbitrary File reading.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01917 · Published 2020-09-30 · No fix listed CWE-22
Priority LOW 36
There is an Arbitrary file deletion vulnerability in halo v1.1.3.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.01123 · Published 2020-09-30 · No fix listed CWE-22
Priority LOW 35
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00881 · Published 2022-04-05 · No fix listed CWE-434
Priority LOW 35
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01242 · Published 2021-07-12 · No fix listed CWE-918
Priority LOW 35
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01512 · Published 2019-12-26 · No fix listed CWE-918
Priority LOW 29
Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00807 · Published 2021-05-20 · No fix listed CWE-79
Priority LOW 29
Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0074 · Published 2021-07-12 · No fix listed CWE-79
Priority LOW 28
Halo is an open source website building tool.
CVSS 4.0MEDIUM 5.5· Network · No auth · No interaction · EPSS 0.00827 · Published 2025-04-25 · Fixed in 2.20.13 CWE-79
Priority LOW 28
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00609 · Published 2018-05-12 · No fix listed CWE-79
Priority LOW 28
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00609 · Published 2018-05-12 · No fix listed CWE-79
Priority LOW 27
Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00237 · Published 2025-09-09 · No fix listed CWE-79
Priority LOW 27
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00257 · Published 2025-09-09 · No fix listed CWE-79
Load more
THREATIST.IORead the docs