TI-2025-10089 CVE-2025-11019 · GHSA-898q-xx7r-c36p
Total.js CMS Files Menu cross site scripting
Priority MEDIUM 55
A vulnerability has been found in Total.js CMS up to 19.9.0.
Vulnerabilities
12 records
TI-2025-10016 CVE-2025-10940 · GHSA-92hj-qq4q-mm96
Total.js CMS Layout admin layouts_save cross site scripting
Priority MEDIUM 55
A vulnerability was found in Total.js CMS 1.0.0.
TI-2024-32459 CVE-2024-48655 · GHSA-v7cp-2p68-gp8h
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.
Priority HIGH 73
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.
TI-2022-21645 CVE-2022-44019 · GHSA-5g8m-7pjc-g6vr
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via…
Priority HIGH 73
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.
TI-2022-19859 CVE-2022-41392 · GHSA-6c4g-j5rf-mc73
A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to…
Priority LOW 26
A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.
TI-2022-12345 CVE-2022-30013 · GHSA-72r3-9fpx-mq44
A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS…
Priority LOW 25
A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file.
TI-2021-12496 CVE-2021-32831 · GHSA-vwhc-pww7-72x6
Code injection in total.js
Priority LOW 36
Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC.
TI-2021-06082 CVE-2021-23389 · GHSA-7fm6-gxqg-2pwr
Arbitrary code execution in total.js
Priority MEDIUM 48
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
TI-2021-06042 CVE-2021-23344 · GHSA-3wj8-vp9h-rm6m
Remote code execution (RCE) in total.js
Priority MEDIUM 50
The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
TI-2020-17298 CVE-2020-28494 · GHSA-4449-hg37-77v8
Command injection in total.js
Priority MEDIUM 41
This affects the package total.js before 3.4.7.
TI-2020-17299 CVE-2020-28495 · GHSA-6cf8-qhqj-vjqm
Prototype pollution in total.js
Priority LOW 39
This affects the package total.js before 3.4.7.
TI-2019-06421 CVE-2019-8903 · GHSA-3q32-j57w-q4w7
index.js in Total.js Platform before 3.2.3 allows path traversal.
Priority HIGH 71
index.js in Total.js Platform before 3.2.3 allows path traversal.