Vendors / Total.js Records 27 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 9
Exploited now Total.js records in CISA KEV No Total.js vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 73
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01034 · Published 2024-10-25 · No fix listed CWE-94
Priority HIGH 73
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02796 · Published 2022-10-29 · No fix listed CWE-78
Priority HIGH 71
index.js in Total.js Platform before 3.2.3 allows path traversal.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.72058 · Published 2019-02-18 · Fixed in 3.2.3 CWE-22
Priority MEDIUM 55
A vulnerability has been found in Total.js CMS up to 19.9.0.
CVSS 4.0 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00242 · Published 2025-09-26 · No fix listed CWE-79
Priority MEDIUM 55
A vulnerability was found in Total.js CMS 1.0.0.
CVSS 4.0 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00264 · Published 2025-09-25 · No fix listed CWE-79
Priority MEDIUM 50
The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04879 · Published 2021-03-04 · Fixed in 3.4.8 CWE-94
Priority MEDIUM 48
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03603 · Published 2021-07-12 · Fixed in 3.4.9 CWE-94
Priority MEDIUM 41
This affects the package total.js before 3.4.7.
CVSS 3.1 HIGH 8.6· Network · No auth · No interaction · EPSS 0.01723 · Published 2021-02-02 · Fixed in 3.4.7 CWE-78
Priority LOW 39
This affects the package total.js before 3.4.7.
CVSS 3.1 HIGH 7.3· Network · No auth · No interaction · EPSS 0.0376 · Published 2021-02-02 · Fixed in 3.4.7 CWE-1321
Priority LOW 36
Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC.
CVSS 3.1 HIGH 7.5· Local · High privileges · No interaction · EPSS 0.01466 · Published 2021-08-30 · Fixed in 3.4.9 CWE-94
Priority LOW 26
A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00867 · Published 2022-10-07 · No fix listed CWE-79
Priority LOW 25
A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00624 · Published 2022-05-16 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
4 9 14 0 0
THREATIST.IORead the docs