CVE-2025-44593: Improper Neutralization of Input During Web Page Generation

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13...

Halo 跨站脚本漏洞

Halo is a powerful and easy-to-use open source site builder from Halo Open Source. A security vulnerability exists in Halo versions prior to 2.20.13, which stems from a file type validation bypass that could lead to a stored cross-site scripting attack or remote code execution...