CVE-2020-21524

PoC —

CVSS 3.1

9.1 critical

EPSS

2%p73

Published

Sep 30, 2020 (Sep 30, 2020)

Modified

Jun 17, 2026

Description

There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423

Vendors: halo
Products: halo
Ecosystems: WordPress
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.