Login Request a demo
HA
Vendor
halo-dev
1 product with CVEs on record
37
CVEs
0
On KEV
1
New 30D
Products
HA
halo
halo-dev
9.8
37 CVEs0 on KEV1 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-116117
New
HA
halo
halo-dev
7.3
1%
Oct 26halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
CVE-2026-97182
HA
Halo
halo-dev
7.3
0%
Sep 24halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
CVE-2026-16088
HA
halo
halo-dev
4.7
0%
Jul 18halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal
CVE-2026-15326
HA
halo
halo-dev
3.8
1%
Jul 10halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal
CVE-2025-70886
HA
Halo
Halo
7.5
1%
Feb 12An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
CVE-2025-15141
HA
Halo
Halo
3.1
0%
Dec 28Halo Configuration actuator information disclosure
CVE-2025-44594
HA
Halo
Halo
9.1
0%
Sep 9halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url
CVE-2025-44595
HA
Halo
Halo
6.1
0%
Sep 9Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}
CVE-2025-44593
HA
Halo
Halo
6.1
0%
Sep 9Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files
CVE-2024-56156
HA
Halo
Halo
9.0
1%
Apr 25Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
CVE-2024-43793
HA
Halo
Halo
6.4
0%
Sep 11Halo's editor has a stored XSS vulnerability
CVE-2024-43792
HA
Halo
Halo
6.1
0%
Sep 2Halo's editor has a stored Cross-Site Scripting vulnerability
CVE-2023-33528
HA
Halo
Halo
6.1
0%
Mar 28halo v1.6.0 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-27164
HA
Halo
Halo
4.8
1%
Mar 10An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file
CVE-2022-32995
HA
Halo
Halo
9.8
18%
Jun 27Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function
CVE-2022-32994
HA
Halo
Halo
9.8
19%
Jun 27Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload
CVE-2022-26619
HA
Halo
Halo
7.5
1%
Apr 5Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function
CVE-2021-43659
HA
Halo
Halo
5.4
1%
Mar 24In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability
CVE-2022-22125
HA
Halo
Halo
4.8
1%
Jan 13In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag
CVE-2020-23079
HA
Halo
Halo
7.5
1%
Jul 12SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet
CVE-2020-19038
HA
Halo
Halo
9.1
1%
Jul 12File Deletion vulnerability in Halo 0.4.3 via delBackup
CVE-2020-19037
HA
Halo
Halo
5.3
1%
Jul 12Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies
CVE-2020-18982
HA
Halo
Halo
5.4
1%
Jul 12Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl
CVE-2020-18980
HA
Halo
Halo
9.8
1%
Jul 12Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters
CVE-2020-18979
HA
Halo
Halo
6.1
1%
Jul 12Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter
CVE-2020-21345
HA
Halo
Halo
6.1
1%
May 20Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code
CVE-2020-21527
HA
Halo
Halo
7.7
1%
Sep 30There is an Arbitrary file deletion vulnerability in halo v1.1.3
CVE-2020-21526
HA
Halo
Halo
9.8
2%
Sep 30An Arbitrary file writing vulnerability in halo v1.1.3
CVE-2020-21525
HA
Halo
Halo
7.5
2%
Sep 30Halo V1.1.3 is affected by: Arbitrary File reading
CVE-2020-21524
HA
Halo
Halo
9.1
2%
Sep 30There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml…
CVE-2020-21523
HA
Halo
Halo
9.8
3%
Sep 30A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function
CVE-2020-21522
HA
Halo
Halo
9.8
2%
Sep 30An issue was discovered in halo V1.1.3
CVE-2020-19007
HA
Halo
Halo
5.4
0%
Aug 26Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments
CVE-2019-19999
HA
Halo
Halo
7.2
2%
Dec 26Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration
CVE-2019-16890
HA
Halo
Halo
5.4
1%
Sep 25Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments
CVE-2018-11012
HA
Halo
Halo
6.1
1%
May 12ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java
CVE-2018-11011
HA
Halo
Halo
6.1
1%
May 12ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java