Totaljs Total.js_cms
6 CVEs affecting Totaljs Total.js_cms. Latest disclosed: 2020-02-24. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15954 | Critical | 9.9 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote… |
CVE-2019-15953 | High | 8.8 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the… |
CVE-2019-15952 | High | 8.8 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .html files… |
CVE-2020-9381 | High | 7.5 | 2020-02-24 | controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in c… |
CVE-2019-15955 | Medium | 6.5 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If… |
CVE-2019-10260 | Medium | 6.1 | 2019-03-28 | Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). |