CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-56156 – Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
https://notcve.org/view.php?id=CVE-2024-56156
25 Apr 2025 — Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13. • https://github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43793 – Halo's editor has a stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2024-43793
11 Sep 2024 — Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0. • https://github.com/halo-dev/halo/security/advisories/GHSA-28x9-hppj-m537 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43792 – Halo's editor has a stored Cross-Site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2024-43792
02 Sep 2024 — Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability. • https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27164
https://notcve.org/view.php?id=CVE-2023-27164
10 Mar 2023 — An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. • http://halo.com • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2022-32995
https://notcve.org/view.php?id=CVE-2022-32995
27 Jun 2022 — Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. Se ha detectado que Halo CMS versión v1.5.3, contiene una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) por medio de la función template remote download • https://github.com/zongdeiqianxing/cve-reports/issues/2 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2022-32994
https://notcve.org/view.php?id=CVE-2022-32994
27 Jun 2022 — Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. Se ha detectado que Halo CMS versión v1.5.3, contiene una vulnerabilidad de carga de archivos arbitraria por medio del componente /api/admin/attachments/upload • https://github.com/zongdeiqianxing/cve-reports/issues/1 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28074
https://notcve.org/view.php?id=CVE-2022-28074
22 Apr 2022 — Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools. Se ha detectado que Halo versión 1.5.0, contiene una vulnerabilidad de tipo cross-site scripting (XSS) almacenado por medio de \admin\index.html#/system/tools • https://github.com/halo-dev/halo/issues/1769 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-26619
https://notcve.org/view.php?id=CVE-2022-26619
05 Apr 2022 — Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. Se ha detectado que Halo Blog CMS versión v1.4.17, permite a atacantes cargar archivos arbitrarios por medio de la función Attachment Upload • https://github.com/halo-dev/halo/issues/1702 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43659
https://notcve.org/view.php?id=CVE-2021-43659
24 Mar 2022 — In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability. En halo versión 1.4.14, el punto de la función de subir el avatar, puede subirse cualquier archivo, como subir un archivo HTML, lo que causará una vulnerabilidad de tipo XSS almacenada • https://github.com/halo-dev/halo/issues/1522 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-22125 – Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag
https://notcve.org/view.php?id=CVE-2022-22125
13 Jan 2022 — In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server. En Halo, versiones v1.0.0 a v1.4.17 (la más reciente) son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado en la etiqueta article. Un atacante autenticado puede inyectar código javascript arbitrario que será ejecutado en el servidor de la víctima • https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L500 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •