5 matches found
CVE-2025-44595
Halo versions v2.20.17 and before are vulnerable to a Cross-Site Scripting (XSS) vulnerability within the /halo_host/archives/{name} API endpoint. The root cause is the improper neutralization of the {name} parameter, which allows for potential script injection. This could lead to the execution o...
CVE-2025-44595
Halo v2.20.17 and before is vulnerable to Cross Site Scripting XSS in /halohost/archives/name...
PT-2025-36959
Name of the Vulnerable Software and Affected Versions: Halo versions prior to v2.20.17 Description: Halo is susceptible to a Cross Site Scripting XSS issue in the /halo host/archives/name API endpoint. The vulnerability resides in the handling of the name parameter, allowing for potential script...
