Vulnerabilities

TI-2025-12899 CVE-2025-14117 · GHSA-rqg8-wp3g-7gvx

fit2cloud Halo cross-site request forgery

MEDIUM 63

A vulnerability has been found in fit2cloud Halo 2.21.10.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00263 Published 2025-12-06 No fix listed CWE-352

TI-2022-10895 CVE-2022-28074 · GHSA-xr4f-cr86-pfhv

LOW 22

Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00428 Published 2022-04-22 No fix listed CWE-79

TI-2022-06468 CVE-2022-22124 · GHSA-g7vj-x88g-9f9w

LOW 26

In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00731 Published 2022-01-13 No fix listed CWE-79

TI-2022-06467 CVE-2022-22123 · GHSA-66cp-6j7w-r93f

LOW 26

In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00731 Published 2022-01-13 No fix listed CWE-79