Read the docs

Total.js

Records27All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

Total.js records in CISA KEV

No Total.js vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Total.js 12 records HIGH Total.js Cms 6 records HIGH Messenger 3 records MEDIUM Openplatform 2 records MEDIUM Content Management System 1 record LOW Flow 1 record MEDIUM Total4 1 record MEDIUM

Records

27 records

TI-2023-14133 CVE-2023-30094 · GHSA-jj45-24rw-v6jw

A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to…

Priority MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00667 Published 2023-05-04 Fixed in 0.0.81 CWE-79
TI-2025-10089 CVE-2025-11019 · GHSA-898q-xx7r-c36p

Total.js CMS Files Menu cross site scripting

Priority MEDIUM 55

A vulnerability has been found in Total.js CMS up to 19.9.0.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2025-09-26 No fix listed CWE-79
TI-2021-06042 CVE-2021-23344 · GHSA-3wj8-vp9h-rm6m

Remote code execution (RCE) in total.js

Priority MEDIUM 50

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04879 Published 2021-03-04 Fixed in 3.4.8 CWE-94
TI-2021-06082 CVE-2021-23389 · GHSA-7fm6-gxqg-2pwr

Arbitrary code execution in total.js

Priority MEDIUM 48

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03603 Published 2021-07-12 Fixed in 3.4.9 CWE-94
TI-2021-06083 CVE-2021-23390 · GHSA-g7mq-rfj2-25wq

Arbitrary code execution in total4

Priority MEDIUM 47

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02987 Published 2021-07-12 Fixed in 0.0.43 CWE-94
TI-2020-17298 CVE-2020-28494 · GHSA-4449-hg37-77v8

Command injection in total.js

Priority MEDIUM 41

This affects the package total.js before 3.4.7.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01723 Published 2021-02-02 Fixed in 3.4.7 CWE-78
TI-2020-17299 CVE-2020-28495 · GHSA-6cf8-qhqj-vjqm

Prototype pollution in total.js

Priority LOW 39

This affects the package total.js before 3.4.7.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0376 Published 2021-02-02 Fixed in 3.4.7 CWE-1321
TI-2021-12496 CVE-2021-32831 · GHSA-vwhc-pww7-72x6

Code injection in total.js

Priority LOW 36

Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC.

CVSS 3.1HIGH 7.5 Local High privileges No interaction EPSS 0.01466 Published 2021-08-30 Fixed in 3.4.9 CWE-94
Load more
Open these records in search →