CVE-2025-70886 | High | 7.5 | 2026-02-12 | An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint |
CVE-2025-15141 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler… |
CVE-2025-44595 | Medium | 6.1 | 2025-09-09 | Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}. |
CVE-2025-44593 | Medium | 6.1 | 2025-09-09 | Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger st… |
CVE-2025-44594 | Critical | 9.1 | 2025-09-09 | halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url. |
CVE-2024-56156 | Critical | 9.0 | 2025-04-25 | Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This… |
CVE-2024-43793 | Medium | 6.3 | 2024-09-11 | Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability… |
CVE-2024-43792 | Medium | 6.3 | 2024-09-02 | Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability… |
CVE-2023-33528 | Medium | 6.1 | 2024-03-28 | halo v1.6.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-27164 | Medium | 4.8 | 2023-03-10 | An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. |
CVE-2022-32995 | Critical | 9.8 | 2022-06-27 | Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. |
CVE-2022-32994 | Critical | 9.8 | 2022-06-27 | Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. |
CVE-2022-26619 | High | 7.5 | 2022-04-05 | Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. |
CVE-2021-43659 | Medium | 5.4 | 2022-03-24 | In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerabili… |
CVE-2022-22125 | Medium | 4.8 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject… |
CVE-2020-23079 | High | 7.5 | 2021-07-12 | SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet. |
CVE-2020-19038 | Critical | 9.1 | 2021-07-12 | File Deletion vulnerability in Halo 0.4.3 via delBackup. |
CVE-2020-19037 | Medium | 5.3 | 2021-07-12 | Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. |
CVE-2020-18982 | Medium | 5.4 | 2021-07-12 | Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl. |
CVE-2020-18980 | Critical | 9.8 | 2021-07-12 | Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters. |
CVE-2020-18979 | Medium | 6.1 | 2021-07-12 | Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter. |
CVE-2020-21345 | Medium | 6.1 | 2021-05-20 | Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary co… |
CVE-2020-21527 | High | 7.7 | 2020-09-30 | There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their backup files, to delet… |
CVE-2020-21526 | Critical | 9.8 | 2020-09-30 | An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input… |
CVE-2020-21525 | High | 7.5 | 2020-09-30 | Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performed on the input path… |
CVE-2020-21524 | Critical | 9.1 | 2020-09-30 | There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) nee… |
CVE-2020-21523 | Critical | 9.8 | 2020-09-30 | A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarke… |
CVE-2020-21522 | Critical | 9.8 | 2020-09-30 | An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attacker can overwrite some files, such as ftl files… |
CVE-2020-19007 | Medium | 5.4 | 2020-08-26 | Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute i… |
CVE-2019-19999 | High | 7.2 | 2019-12-26 | Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration. |
CVE-2019-16890 | Medium | 5.4 | 2019-09-25 | Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments. |
CVE-2018-11012 | Medium | 6.1 | 2018-05-12 | ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java. |
CVE-2018-11011 | Medium | 6.1 | 2018-05-12 | ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java. |