bloater-renewed (1.0.0), foxify-benchmarks (>=0.1.0, <=0.2.0) +1 more potentially affected by unknown CVE via total.js (2.9.30)

total.js NPM version 2.9.30 is affected by a known vulnerability. The following packages have a transitive dependency on total.js and may be impacted: - bloater-renewed 1.0.0 - foxify-benchmarks =0.1.0, =0.2.0 - vuejs-totaljs-project 1.0.0 Source cves: unknown CVE Source advisory: MEND:WS-2019-02...

CVE-2022-26565

A cross-site scripting XSS vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Name text field when creating a new page...

CVE-2025-11655 Total.js Flow SVG File unrestricted upload

A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the component SVG File Handler. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been...

EUVD-2023-30858

Malicious code in bioql PyPI...

EUVD-2023-1569

Malicious code in bioql PyPI...

EUVD-2023-34528

Malicious code in bioql PyPI...

EUVD-2023-34526

Malicious code in bioql PyPI...

EUVD-2022-44587

Malicious code in bioql PyPI...

EUVD-2023-34527

Malicious code in bioql PyPI...

EUVD-2023-30859

Malicious code in bioql PyPI...

EUVD-2022-35228

Malicious code in bioql PyPI...

EUVD-2022-31121

Malicious code in bioql PyPI...

CVE-2025-10940 Total.js CMS Layout admin layouts_save cross site scripting

A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layoutssave of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack remotely. The exploit h...

CVE-2023-30096

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field...

CVE-2023-30094

A stored cross-site scripting XSS vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module...

CVE-2023-30097

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task field...

CVE-2023-30095

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field...

CVE-2023-27069

A stored cross-site scripting XSS vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the account name field...

CVE-2023-27070

A stored cross-site scripting XSS vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field...

CVE-2022-41392

A cross-site scripting XSS vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings...