CVE-2025-44595

Halo v2.20.17 and earlier is vulnerable to Cross-Site Scripting (XSS) through the /halo_host/archives/{name} endpoint. The issue affects the handling of the name parameter and can allow script injection. Multiple sources confirm the affected versions are prior to v2.20.17, with a suggested remedi...