Priority HIGH 72
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00524 · Published 2026-02-12 · No fix listed CWE-400
Priority MEDIUM 45
A vulnerability was determined in Halo up to 2.21.10.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00253 · Published 2025-12-28 · No fix listed CWE-200
Priority LOW 27
Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00237 · Published 2025-09-09 · No fix listed CWE-79
Priority HIGH 78
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00373 · Published 2025-09-09 · No fix listed CWE-918
Priority LOW 27
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00257 · Published 2025-09-09 · No fix listed CWE-79
Priority LOW 28
Halo is an open source website building tool.
CVSS 4.0MEDIUM 5.5· Network · No auth · No interaction · EPSS 0.00827 · Published 2025-04-25 · Fixed in 2.20.13 CWE-79
Priority MEDIUM 64
Halo is an open source website building tool.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00325 · Published 2024-09-11 · Fixed in 2.19.0 CWE-79
Priority MEDIUM 61
Halo is an open source website building tool.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00351 · Published 2024-09-02 · Fixed in 2.17.0 CWE-79
Priority LOW 27
halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00311 · Published 2024-03-28 · No fix listed CWE-79
Priority LOW 23
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00687 · Published 2023-03-10 · No fix listed CWE-434
Priority MEDIUM 59
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.17629 · Published 2022-06-27 · No fix listed CWE-918
Priority MEDIUM 60
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18539 · Published 2022-06-27 · No fix listed CWE-434
Priority LOW 35
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00881 · Published 2022-04-05 · No fix listed CWE-434
Priority LOW 25
In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00551 · Published 2022-03-24 · No fix listed CWE-79
Priority LOW 24
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00856 · Published 2022-01-13 · No fix listed CWE-79
Priority MEDIUM 42
File Deletion vulnerability in Halo 0.4.3 via delBackup.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01168 · Published 2021-07-12 · No fix listed CWE-862
Priority LOW 26
Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00886 · Published 2021-07-12 · No fix listed CWE-287
Priority LOW 35
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01242 · Published 2021-07-12 · No fix listed CWE-918
Priority LOW 25
Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00569 · Published 2021-07-12 · No fix listed CWE-79
Priority MEDIUM 45
Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0146 · Published 2021-07-12 · No fix listed
Priority LOW 29
Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0074 · Published 2021-07-12 · No fix listed CWE-79
Priority LOW 29
Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00807 · Published 2021-05-20 · No fix listed CWE-79
Priority LOW 36
There is an Arbitrary file deletion vulnerability in halo v1.1.3.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.01123 · Published 2020-09-30 · No fix listed CWE-22
Priority MEDIUM 46
An Arbitrary file writing vulnerability in halo v1.1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0189 · Published 2020-09-30 · No fix listed CWE-22
Priority LOW 37
Halo V1.1.3 is affected by: Arbitrary File reading.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01917 · Published 2020-09-30 · No fix listed CWE-22
Load more
THREATIST.IORead the docs