Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

27 records

Vendor: Total.js Clear all filters
TI-2025-10685 CVE-2025-11655 · GHSA-7gx8-8jq4-q6j2

Total.js Flow SVG File unrestricted upload

Priority LOW 23

A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00281 Published 2025-10-13 No fix listed CWE-284
TI-2025-10089 CVE-2025-11019 · GHSA-898q-xx7r-c36p

Total.js CMS Files Menu cross site scripting

Priority MEDIUM 55

A vulnerability has been found in Total.js CMS up to 19.9.0.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2025-09-26 No fix listed CWE-79
TI-2023-14133 CVE-2023-30094 · GHSA-jj45-24rw-v6jw

A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to…

Priority MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00667 Published 2023-05-04 Fixed in 0.0.81 CWE-79
TI-2022-09879 CVE-2022-26565 · GHSA-g837-7gx4-95rv

A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit…

Priority LOW 23

A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Name text field when…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00541 Published 2022-04-01 No fix listed CWE-79
TI-2021-12496 CVE-2021-32831 · GHSA-vwhc-pww7-72x6

Code injection in total.js

Priority LOW 36

Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC.

CVSS 3.1HIGH 7.5 Local High privileges No interaction EPSS 0.01466 Published 2021-08-30 Fixed in 3.4.9 CWE-94
TI-2021-06082 CVE-2021-23389 · GHSA-7fm6-gxqg-2pwr

Arbitrary code execution in total.js

Priority MEDIUM 48

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03603 Published 2021-07-12 Fixed in 3.4.9 CWE-94
TI-2021-06083 CVE-2021-23390 · GHSA-g7mq-rfj2-25wq

Arbitrary code execution in total4

Priority MEDIUM 47

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02987 Published 2021-07-12 Fixed in 0.0.43 CWE-94
TI-2021-06042 CVE-2021-23344 · GHSA-3wj8-vp9h-rm6m

Remote code execution (RCE) in total.js

Priority MEDIUM 50

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04879 Published 2021-03-04 Fixed in 3.4.8 CWE-94
TI-2020-17298 CVE-2020-28494 · GHSA-4449-hg37-77v8

Command injection in total.js

Priority MEDIUM 41

This affects the package total.js before 3.4.7.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01723 Published 2021-02-02 Fixed in 3.4.7 CWE-78
TI-2020-17299 CVE-2020-28495 · GHSA-6cf8-qhqj-vjqm

Prototype pollution in total.js

Priority LOW 39

This affects the package total.js before 3.4.7.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0376 Published 2021-02-02 Fixed in 3.4.7 CWE-1321
Load more