Totaljs

Total.Js Cms

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2024-48655

Exploit
  • EPSS 4.19%
  • Veröffentlicht 25.10.2024 17:15:04
  • Zuletzt bearbeitet 27.05.2025 20:44:36

An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.

7.5

CVE-2020-9381

Exploit
  • EPSS 2.55%
  • Veröffentlicht 24.02.2020 22:15:12
  • Zuletzt bearbeitet 21.11.2024 05:40:31

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.

9.9

CVE-2019-15954

Exploit
  • EPSS 56.91%
  • Veröffentlicht 05.09.2019 19:16:32
  • Zuletzt bearbeitet 21.11.2024 04:29:48

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that wi...

6.5

CVE-2019-15955

Exploit
  • EPSS 0.13%
  • Veröffentlicht 05.09.2019 19:16:32
  • Zuletzt bearbeitet 21.11.2024 04:29:48

An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute f...

8.8

CVE-2019-15952

Exploit
  • EPSS 7.58%
  • Veröffentlicht 05.09.2019 19:16:31
  • Zuletzt bearbeitet 21.11.2024 04:29:48

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .html files that are outside the permitted directory. Also, if a page contains a template directive, t...

8.8

CVE-2019-15953

Exploit
  • EPSS 0.71%
  • Veröffentlicht 05.09.2019 19:16:31
  • Zuletzt bearbeitet 21.11.2024 04:29:48

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource pa...

6.1

CVE-2019-10260

  • EPSS 0.33%
  • Veröffentlicht 28.03.2019 17:29:00
  • Zuletzt bearbeitet 21.11.2024 04:18:45

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).