CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 中危6.1 |
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13 |
| 09/09/2025 |
| CVE-2025-44594 | 严重9.1 | halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url. | 09/09/2025 |
| CVE-2024-56156 | 严重9.0 | Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote cod | 25/04/2025 |
| CVE-2024-43793 | 中危6.4 | Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (X | 11/09/2024 |
| CVE-2024-43792 | 中危6.1 | Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (X | 02/09/2024 |
| CVE-2023-33528 | 中危6.1 | halo v1.6.0 is vulnerable to Cross Site Scripting (XSS). | 28/03/2024 |
| CVE-2023-27164 | 中危4.8 | An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. | 10/03/2023 |
| CVE-2022-32995 | 严重9.8 | Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. | 27/06/2022 |
| CVE-2022-32994 | 严重9.8 | Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. | 27/06/2022 |
| CVE-2022-26619 | 高危7.5 | Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. | 05/04/2022 |
| CVE-2021-43659 | 中危5.4 | In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability. | 24/03/2022 |
| CVE-2022-22125 | 中危4.8 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server. | 13/01/2022 |
| CVE-2020-23079 | 高危7.5 | SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet. | 12/07/2021 |
| CVE-2020-19038 | 严重9.1 | File Deletion vulnerability in Halo 0.4.3 via delBackup. | 12/07/2021 |
| CVE-2020-19037 | 中危5.3 | Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. | 12/07/2021 |
| CVE-2020-18982 | 中危5.4 | Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl. | 12/07/2021 |
| CVE-2020-18980 | 严重9.8 | Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters. | 12/07/2021 |