CVE-2025-11019 | Low | 2.4 | 2025-09-26 | A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site… |
CVE-2025-10940 | Low | 2.4 | 2025-09-25 | A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page… |
CVE-2024-48655 | High | 8.8 | 2024-10-25 | An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file. |
CVE-2023-30097 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-30096 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-30095 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-30094 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2023-27070 | Medium | 5.4 | 2023-03-14 | A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafte… |
CVE-2023-27069 | Medium | 5.4 | 2023-03-14 | A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafte… |
CVE-2022-44019 | High | 8.8 | 2022-10-30 | In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter. |
CVE-2022-41392 | Medium | 5.4 | 2022-10-07 | A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-30013 | Medium | 5.4 | 2022-05-16 | A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScrip… |
CVE-2022-26565 | Medium | 4.8 | 2022-04-01 | A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2021-32831 | High | 7.5 | 2021-08-30 | Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET… |
CVE-2021-23390 | Critical | 9.8 | 2021-07-12 | The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. |
CVE-2021-23389 | Critical | 9.8 | 2021-07-12 | The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. |
CVE-2021-23344 | Critical | 9.8 | 2021-03-04 | The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set. |
CVE-2020-28495 | High | 7.3 | 2021-02-02 | This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path… |
CVE-2020-28494 | High | 8.6 | 2021-02-02 | This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command… |
CVE-2020-9381 | High | 7.5 | 2020-02-24 | controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in c… |
CVE-2019-15955 | Medium | 6.5 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If… |
CVE-2019-15954 | Critical | 9.9 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote… |
CVE-2019-15953 | High | 8.8 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the… |
CVE-2019-15952 | High | 8.8 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .html files… |
CVE-2019-10260 | Medium | 6.1 | 2019-03-28 | Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). |
CVE-2019-8903 | High | 7.5 | 2019-02-18 | index.js in Total.js Platform before 3.2.3 allows path traversal. |