PT-2025-36945

CVE-2025-44593

·

Published

2025-09-09

·

Updated

2025-09-18

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Halo versions prior to 2.20.13
Description: Halo versions prior to 2.20.13 allow bypassing file type detection, enabling the upload of malicious files, including .exe and .html files. Uploading .html files can trigger stored cross-site scripting (XSS) vulnerabilities.
Recommendations: Update to version 2.20.13 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2025-44593
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com