69 matches found
CVE-2019-15955
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with On=2n instead of On=n^x complexity...
CVE-2019-15954: Total.js CMS 12 Widget Remote Code Execution
Total.js is a Node.js Framework for building e-commerce applications, REST services, real-time apps, or apps for Internet of Things IoT, etc. Total.js CMS is a Content Management System application that is part of the Total.js framework. A commercial version is also available, and can be seen use...
Total.js CMS 12 Widget JavaScript Code Injection
This module exploits a vulnerability in Total.js CMS. The issue is that a user with admin permission can embed a malicious JavaScript payload in a widget, which is evaluated server side, and gain remote code execution. Module Options msf use exploit/multi/http/totaljs/cmswidgetexec msf...
GHSA-72P5-2R6G-FM6V Moderate severity vulnerability that affects total.js
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...
Moderate severity vulnerability that affects total.js
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...
Total.js CMS Cross-Site Scripting Vulnerability
Total.js CMS is a content management system CMS based on a NoSQL database. A cross-site scripting vulnerability exists in Total.js CMS version 12.0.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
CVE-2019-10260
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...
