Arron-bit - Security Researcher - Exploit Intelligence Platform

CVE-2026-36756 WRITEUP MEDIUM WRITEUP

Halo v2.22.14 - Server-Side Request Forgery

A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

CVSS 5.4

View Code

CVE-2026-36758 WRITEUP MEDIUM WRITEUP

Halo v2.22.14 - Server-Side Request Forgery

A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

CVSS 4.3

View Code

CVE-2026-36759 WRITEUP MEDIUM WRITEUP

Halo v2.22.14 - Server-Side Request Forgery

A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

CVSS 6.5

View Code