Halo's editor has a stored XSS vulnerability

Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files

Halo's editor has a stored Cross-Site Scripting vulnerability

halo v1.6.0 is vulnerable to Cross Site Scripting (XSS)

Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter

Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code

ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java

ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java

In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability

Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments

Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments

Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies

An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file

Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag

halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal