CMS
by Totaljs
Source repositories
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-48655 | Hig | 0.57 | 8.8 | 0.01 | Oct 25, 2024 | An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file. | ||
| CVE-2019-15955 | Med | 0.42 | 6.5 | 0.01 | Sep 5, 2019 | An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead… | ||
| CVE-2022-41392 | Med | 0.35 | 5.4 | 0.01 | Oct 7, 2022 | A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings. | ||
| CVE-2022-30013 | Med | 0.35 | 5.4 | 0.01 | May 16, 2022 | A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file. | ||
| CVE-2019-10260 | Med | 0.33 | 6.1 | 0.01 | Mar 28, 2019 | Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). | ||
| CVE-2025-11019 | Low | 0.16 | 2.4 | 0.00 | Sep 26, 2025 | A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||
| CVE-2025-10940 | Low | 0.16 | 2.4 | 0.00 | Sep 25, 2025 | A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack… | ||
| CVE-2020-9381 | Hig | 0.00 | 7.5 | 0.02 | Feb 24, 2020 | controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954. |
- risk 0.57cvss 8.8epss 0.01
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead…
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file.
- risk 0.33cvss 6.1epss 0.01
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
- risk 0.16cvss 2.4epss 0.00
A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- risk 0.16cvss 2.4epss 0.00
A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack…
- risk 0.00cvss 7.5epss 0.02
controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.