69 matches found
CVE-2024-48655
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file...
CVE-2024-48655
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file...
CVE-2024-48655
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file...
Total.js CMS 安全漏洞
Total.js CMS is a NoSQL database-based content management system CMS from Total.js. A security vulnerability exists in Total.js CMS version v1.0, which stems from a vulnerability that allows remote attackers to execute arbitrary code via the func.js file...
PT-2024-33175 · Unknown · Total.Js Cms
Name of the Vulnerable Software and Affected Versions: Total.js CMS version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the func.js file. Recommendations: For Total.js CMS version 1.0, update the func.js file to prevent arbitrary code execution or consider...
CVE-2024-48655
CVE-2024-48655 affects Total.js CMS v1.0. The vulnerability is a remote code execution through the func.js file, as documented by multiple sources (Red Hat, NVD, OSV, CNNVD, CVE listing, PT Security). Root cause specifics are not expanded in the provided materials beyond path and impact. Remediat...
CVE-2024-48655
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file...
GHSA-Q3X9-28F7-W8RC Total.js CMS Unauthorized Access
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertica...
GHSA-PWVP-H579-HFXG Total.js CMS Path Traversal
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack ../ to include .html files that are outside the permitted directory. Also, if a page contains a template directive, then the directive will be server side processed...
Total.js CMS Path Traversal
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack ../ to include .html files that are outside the permitted directory. Also, if a page contains a template directive, then the directive will be server side processed...
Total.js CMS Unauthorized Access
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertica...
Total.js CMS RCE Vulnerability
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...
Total.js CMS Remote Code Execution Vulnerability
Total.js CMS is a content management system CMS based on a NoSQL database. A security vulnerability exists in the controllers/admin.js file in version 13 of Total.js CMS. The vulnerability can be exploited by a remote attacker to execute arbitrary code by sending a POST request to the...
CVE-2020-9381
controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...
CVE-2020-9381
controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...
Design/Logic Flaw
controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...
CVE-2020-9381
Summary of findings (Total.js CMS): CVE-2020-9381 and related CVEs affect Total.js CMS (notably version 13) with remote code execution via a POST to /admin/api/widgets/ on controllers/admin.js. The root cause is a widget handling path that can evaluate malicious JavaScript payloads, enabling an a...
Total.js CMS 12 - Widget JavaScript Code Injection Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Total.js CMS 12 Widget JavaScript Code Injection', 'Description' = %q This module exploits a vulnerability in Total.js CMS. The issue is that a...
Total.js CMS 12 Widget JavaScript Code Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Total.js CMS 12 Widget JavaScript Code Injection', 'Description' = %q This module exploits a vulnerability in Total.js CMS. The issue is that a...
Total.js CMS 12 Widget JavaScript Code Injection
This module exploits a vulnerability in Total.js CMS. The issue is that a user with admin permission can embed a malicious JavaScript payload in a widget, which is evaluated server side, and gain remote code execution. This module requires Metasploit: https://metasploit.com/download Current sourc...