Skip to content
Noroxi

totaljs records

26 published records for vendor totaljs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 7.7%
Pre-auth RCE
6
With a fix record
34.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2019-15954
    63This week

    An issue was discovered in Total.js CMS 12.0.0.

    CriticalCVSS 9.9WeaponizedEPSS 79%

    totaljs · total.js cmsSep 5, 2019

  • CVE-2019-8903
    52Plan

    index.js in Total.js Platform before 3.2.3 allows path traversal.

    HighCVSS 7.5WeaponizedEPSS 72%

    totaljs · total.jsFeb 18, 2019

  • CVE-2021-23344
    40Plan

    Remote Code Execution (RCE)

    CriticalCVSS 9.8No exploitEPSS 5%

    totaljs · total.jsMar 4, 2021

  • CVE-2021-23389
    40Plan

    Arbitrary Code Execution

    CriticalCVSS 9.8No exploitEPSS 4%

    totaljs · total.jsJul 12, 2021

  • CVE-2021-23390
    40Plan

    Arbitrary Code Execution

    CriticalCVSS 9.8No exploitEPSS 3%

    totaljs · total4Jul 12, 2021

  • CVE-2019-15952
    37Monitor

    An issue was discovered in Total.js CMS 12.0.0.

    HighCVSS 8.8No exploitEPSS 5%

    totaljs · total.js cmsSep 5, 2019

  • CVE-2022-44019
    36Monitor

    In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.

    HighCVSS 8.8No exploitEPSS 2%

    totaljs · total.jsOct 29, 2022

  • CVE-2020-28494
    35Monitor

    This affects the package total.js before 3.4.7.

    HighCVSS 8.6No exploitEPSS 2%

    totaljs · total.jsFeb 2, 2021

  • CVE-2019-15953
    35Monitor

    An issue was discovered in Total.js CMS 12.0.0.

    HighCVSS 8.8No exploitEPSS 2%

    totaljs · total.js cmsSep 5, 2019

  • CVE-2024-48655
    35Monitor

    An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.

    HighCVSS 8.8No exploitEPSS 1%

    totaljs · total.jsOct 25, 2024

  • CVE-2020-9381
    31Monitor

    controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI.

    HighCVSS 7.5No exploitEPSS 2%

    totaljs · total.js cmsFeb 24, 2020

  • CVE-2020-28495
    30Monitor

    This affects the package total.js before 3.4.7.

    HighCVSS 7.3No exploitEPSS 4%

    totaljs · total.jsFeb 2, 2021

  • CVE-2021-32831
    28Monitor

    Code injection in total.js

    HighCVSS 7.2No exploitEPSS 1%

    totaljs · total.jsAug 30, 2021

  • CVE-2019-15955
    26Monitor

    An issue was discovered in Total.js CMS 12.0.0.

    MediumCVSS 6.5No exploitEPSS 1%

    totaljs · total.js cmsSep 5, 2019

  • CVE-2019-10260
    24Monitor

    Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).

    MediumCVSS 6.1No exploitEPSS 1%

    totaljs · total.js cmsMar 28, 2019

  • CVE-2022-41392
    21Monitor

    A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafte

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · total.jsOct 7, 2022

  • CVE-2023-30095
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or H

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · messengerMay 4, 2023

  • CVE-2023-30097
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or H

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · messengerMay 4, 2023

  • CVE-2023-30096
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or H

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · messengerMay 4, 2023

  • CVE-2023-30094
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafte

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · flowMay 4, 2023

  • CVE-2022-30013
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scri

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · total.jsMay 16, 2022

  • CVE-2023-27070
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts o

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · openplatformMar 14, 2023

  • CVE-2023-27069
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts o

    MediumCVSS 5.4No exploitEPSS 1%

    totaljs · openplatformMar 14, 2023

  • CVE-2022-26565
    19Monitor

    A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web sc

    MediumCVSS 4.8No exploitEPSS 1%

    totaljs · content management systemApr 1, 2022

  • CVE-2025-10940
    7Monitor

    Total.js CMS Layout admin layouts_save cross site scripting

    LowCVSS 1.9No exploitEPSS 0%

    totaljs · total.jsSep 25, 2025