CVE-2025-70886

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint...

CVE-2026-26000

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in...

CVE-2026-26000

CVE-2026-26000 : XWiki Platform is vulnerable to CSS-injection in comments that can transform the entire wiki UI into a clickable link area leading to a malicious page. Affected versions are prior to 17.9.0, 17.4.6, and 16.10.13. The root cause is a comment-based CSS injection that enables a clic...

CVE-2026-26000

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the public comment submission endpoint. An attacker can disrupt service availability by sending a specially crafted payload. Details Denial of Service DoS describes a family of attacks, all aimed at making a...

CVE-2025-70886

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint...

XWiki vulnerable to click-jacking through CSS injection in comments

Impact It's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack. Patches The problem has been patched not by preventing injecting CSS in comments, which is currently a featur...

CVE-2025-70886

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint...

CVE-2025-70886

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint...

PT-2026-7853

Name of the Vulnerable Software and Affected Versions halo versions 2.22.4 and earlier Description An issue allows a remote attacker to cause a denial of service by sending a crafted payload to the public comment submission endpoint. The vulnerable endpoint is /public/comment. The payload is...

XWiki Platform 安全漏洞

The XWiki Platform is an open-source wiki platform designed for creating web collaboration applications. Versions of the XWiki Platform prior to 17.9.0, 17.4.6, and 16.10.13 contained security vulnerabilities. These vulnerabilities stemmed from the possibility of using CSS injection via comments,...

CVE-2025-70886

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint...

CVE-2025-70886

Halo CMS (v2.22.4 and earlier) is vulnerable to a persistent denial-of-service (DoS) attack. A remote attacker can submit a crafted payload—specifically missing fields like subjectRef.version—to the public comment submission endpoint . Once saved, this malformed data triggers an unhandled excepti...

CVE-2025-70886: Uncontrolled Resource Consumption

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint...

Halo 安全漏洞

Halo is a powerful and easy-to-use open-source website building tool developed by Halo. Versions of Halo 2.22.4 and earlier contain security vulnerabilities. These vulnerabilities stem from defects in the public comment submission endpoint, which could allow remote attackers to trigger a...

CVE-2025-70886

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2026:0427-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0427-1 advisory. Update to version 1.25.7. Security issues fixed: - CVE-2025-61732: cmd/go: discrepancy between G...

CVE-2019-25312

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session...

CVE-2019-25312 InoERP 0.7.2 - Persistent Cross-Site Scripting

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session...

CVE-2019-25312

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session...