CVE-2022-22124

CVE-2022-22124 concerns Halo CMS, affected versions v1.0.0–v1.4.17. The vulnerability is a stored cross-site scripting (XSS) in the profile image, where an authenticated attacker can upload a crafted SVG file that triggers arbitrary JavaScript in a victim’s browser. The described impact is client...

CVE-2022-28074

CVE-2022-28074 affects Halo-1.5.0 and is caused by a stored cross-site scripting (XSS) vulnerability reachable via the path admin\index.html#/system/tools. The connected documents confirm Halo-1.5.0 as the vulnerable product and identify XSS as the underlying issue, but do not provide detailed ex...

CVE-2022-22123

Halo CMS contains a Stored XSS vulnerability affecting versions 1.0.0 through 1.4.17 (latest). The flaw is in the article title, allowing an authenticated attacker to inject arbitrary JavaScript that executes on a victim’s server. Root cause is a stored XSS in the title field; impact includes pot...

CVE-2025-14117

CVE-2025-14117 affects fit2cloud Halo 2.21.10. The vulnerability is a cross-site request forgery in an unknown function, exploitable remotely with the exploit publicly disclosed. Multiple sources (NVD, Red Hat, EUVD, OSV, CVE List) confirm the same impact and remote vector. No version fixes are d...