CVE-2025-44595

Halo v2.20.17 and before is vulnerable to Cross Site Scripting XSS in /halohost/archives/name...

PT-2025-36946

Name of the Vulnerable Software and Affected Versions: halo versions prior to 2.20.17 Description: The software is vulnerable to a server-side request forgery SSRF issue. The vulnerability exists in the /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url API endpoint...