CVE-2025-15141

A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high...

CVE-2025-44593

Halo before version 2.20.13 is affected by a vulnerability where file type detection can be bypassed, allowing upload of malicious files such as .exe and .html. The upload of .html files can trigger stored XSS. This issue is fixed in 2.20.13. Affected product/versions are Halo prior to 2.20.13; r...

PT-2025-31954 · Halo · Halo

Name of the Vulnerable Software and Affected Versions: Halo versions prior to 2.20.18LTS Description: The reconcile method within the AttachmentReconciler class is susceptible to Cross-Site Scripting XSS attacks. Recommendations: Update to a version of Halo later than 2.20.18LTS...

CVE-2020-21522

An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attacker can overwrite some files, such as ftl files, .bashrc files in the user directory, and finally get the permissions of the operating system...

CVE-2020-21345

Cross Site Scripting XSS vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code...

CVE-2023-27164

An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file...

PT-2023-20983 · Halo · Halo

Name of the Vulnerable Software and Affected Versions: Halo versions up to 1.6.1 Description: The issue allows attackers to execute arbitrary code via a crafted .md file due to an arbitrary file upload vulnerability. Recommendations: For versions up to 1.6.1, update to a version later than 1.6.1 ...

CVE-2023-27164

An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file...

CVE-2022-22125

In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server...

CVE-2020-23079

SSRF vulnerability in Halo =1.3.2 exists in the SMTP configuration, which can detect the server intranet...