Vulnerabilities

TI-2020-07501 CVE-2020-9381 · GHSA-xhg7-3m9v-pjfp

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code…

LOW 37

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02114 Published 2020-02-24 No fix listed CWE-863

TI-2019-11995 CVE-2019-15952 · GHSA-pwvp-h579-hfxg

MEDIUM 46

An issue was discovered in Total.js CMS 12.0.0.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05119 Published 2019-09-05 No fix listed CWE-22

TI-2019-11996 CVE-2019-15953 · GHSA-q3x9-28f7-w8rc

MEDIUM 41

An issue was discovered in Total.js CMS 12.0.0.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01546 Published 2019-09-05 No fix listed CWE-862

TI-2019-11997 CVE-2019-15954 · GHSA-v287-9w3v-x5c5

HIGH 82

An issue was discovered in Total.js CMS 12.0.0.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.78691 Published 2019-09-05 No fix listed CWE-862

TI-2019-11998 CVE-2019-15955 · GHSA-x2gc-x3q3-8fp4

LOW 30

An issue was discovered in Total.js CMS 12.0.0.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00869 Published 2019-09-05 No fix listed CWE-327

TI-2019-07572 CVE-2019-10260 · GHSA-72p5-2r6g-fm6v

LOW 29

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00905 Published 2019-03-28 Fixed in 3.3.0-13 CWE-79