영향받는 버전 라인
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-116117 | halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal | = 2.27.0-beta.0 = 2.27.0-beta.1 | 6.9 | — | 2026-10-26 | |
| CVE-2026-97182 | halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization | = 2.25.0 = 2.25.1 = 2.25.2 | 6.9 | — | 2026-09-24 | |
| CVE-2026-91772 | Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter | ≤ 2.26.1 | 5.3 | — | 2026-09-15 | |
| CVE-2026-78971 | In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could... | * | 4.6 | — | 2026-09-08 | |
| CVE-2026-67921 | Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigure... | * | 9.3 | — | 2026-08-18 | |
| CVE-2026-67920 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl... | * | 8.8 | — | 2026-08-18 | |
| CVE-2026-67919 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, instal... | * | 9.8 | — | 2026-08-17 | |
| CVE-2026-16088 | halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal | = 2.24.0 = 2.24.1 = 2.24.2 | 5.1 | — | 2026-07-18 | |
| CVE-2026-15326 | halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal | = 2.24.0 = 2.24.1 = 2.24.2 | 5.1 | — | 2026-07-10 | |
| CVE-2026-55439 | Halo: Path Traversal in Backup Download Leads to Arbitrary File Read | * | 5.5 | — | 2026-06-26 | |
| CVE-2026-36757 | A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows... | * | 4.3 | — | 2026-04-30 | |
| CVE-2026-36756 | A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authe... | * | 5.4 | — | 2026-04-30 | |
| CVE-2026-36758 | A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authen... | * | 4.3 | — | 2026-04-30 | |
| CVE-2026-36759 | A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows a... | * | 6.5 | — | 2026-04-30 | |
| CVE-2025-70886 | An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted paylo... | * ≤ 2.22.4 | 7.5 | — | 2026-02-12 | |
| CVE-2025-15141 | Halo Configuration actuator information disclosure | ≤ 2.21.10 | 1.3 | — | 2025-12-28 | |
| CVE-2025-44593 | Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .htm... | < 2.20.13 | 6.1 | — | 2025-09-09 | |
| CVE-2025-44595 | Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}. | ≤ 2.20.17 | 6.1 | — | 2025-09-09 | |
| CVE-2025-44594 | halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/... | ≤ 2.20.17 | 9.1 | — | 2025-09-09 | |
| CVE-2025-51857 | The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerabl... | * | 6.1 | — | 2025-08-05 | |
| CVE-2024-56156 | Halo Vulnerable to Stored XSS and RCE via File Upload Bypass | * < 2.20.13 | 5.5 | — | 2025-04-25 | |
| CVE-2024-43793 | Halo's editor has a stored XSS vulnerability | * < 2.19.0 | 6.4 | — | 2024-09-11 | |
| CVE-2024-43792 | Halo's editor has a stored Cross-Site Scripting vulnerability | * < 2.17.0 | 6.1 | — | 2024-09-02 | |
| CVE-2023-33528 | halo v1.6.0 is vulnerable to Cross Site Scripting (XSS). | * = 1.6.0 | 6.1 | — | 2024-03-28 | |
| CVE-2023-27164 | An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a c... | * ≤ 1.6.1 | 4.8 | — | 2023-03-10 | |
| CVE-2022-32994 | Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/... | = 1.5.3 | 9.8 | — | 2022-06-27 | |
| CVE-2022-32995 | Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote downloa... | = 1.5.3 | 9.8 | — | 2022-06-27 | |
| CVE-2022-28074 | Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/... | * | — | — | 2022-04-22 | |
| CVE-2022-26619 | Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload fu... | * = 1.4.17 | 7.5 | — | 2022-04-05 | |
| CVE-2021-43659 | In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTM... | * = 1.4.14 | 5.4 | — | 2022-03-24 | |
| CVE-2022-22124 | Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image | ≥ v1.0.0 < unspecified ≥ unspecified ≤ v1.4.17 | 5.4 | — | 2022-01-14 | |
| CVE-2022-22123 | Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Title | ≥ v1.0.0 < unspecified ≥ unspecified ≤ v1.4.17 | 5.4 | — | 2022-01-14 | |
| CVE-2022-22125 | Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag | ≥ v1.0.0 < unspecified ≥ unspecified ≤ v1.4.17 ≥ 1.0.0 ≤ 1.4.17 | 4.8 | — | 2022-01-13 | |
| CVE-2020-18982 | Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl. | * = 0.4.3 | 5.4 | — | 2021-07-12 | |
| CVE-2020-19037 | Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to vie... | * = 0.4.3 | 5.3 | — | 2021-07-12 | |
| CVE-2020-19038 | File Deletion vulnerability in Halo 0.4.3 via delBackup. | * = 0.4.3 | 9.1 | — | 2021-07-12 | |
| CVE-2020-23079 | SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet. | * ≤ 1.3.2 | 7.5 | — | 2021-07-12 | |
| CVE-2020-18980 | Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters. | * = 0.4.3 | 9.8 | — | 2021-07-12 | |
| CVE-2020-18979 | Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter. | * = 0.4.3 | 6.1 | — | 2021-07-12 | |
| CVE-2020-21345 | Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which... | * = 1.1.3 | 6.1 | — | 2021-05-20 | |
| CVE-2020-21525 | Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directo... | * = 1.1.3 | 7.5 | — | 2020-09-30 | |
| CVE-2020-21524 | There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in th... | * = 1.1.3 | 9.1 | — | 2020-09-30 | |
| CVE-2020-21526 | An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a di... | * = 1.1.3 | 9.8 | — | 2020-09-30 | |
| CVE-2020-21527 | There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a... | * = 1.1.3 | 7.7 | — | 2020-09-30 | |
| CVE-2020-21522 | An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attack... | * = 1.1.3 | 9.8 | — | 2020-09-30 | |
| CVE-2020-21523 | A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function.... | * = 1.1.3 | 9.8 | — | 2020-09-30 | |
| CVE-2020-19007 | Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript... | * = 1.2.0 | 5.4 | — | 2020-08-26 | |
| CVE-2019-19999 | Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESO... | * ≤ 1.1.1 = 1.1.3 | 7.2 | — | 2019-12-26 | |
| CVE-2019-16890 | Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments. | * = 1.1.0 | 5.4 | — | 2019-09-25 | |
| CVE-2018-11011 | ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java. | = 0.0.2 | 6.1 | — | 2018-05-12 | |
| CVE-2018-11012 | ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to Admin... | = 0.0.2 | 6.1 | — | 2018-05-12 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).