Cross-Site Scripting (XSS)

2022-05-1813:14:45

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

21.4%

JSON

total.js is vulnerable to stored cross-site scripting. The vulnerability exists in upload function due to lack of sanitization which allows an attacker to execute arbitrary javascript via a javascript embedded PDF file.

CPENameOperatorVersion
total.jsle3.4.20
total.jsle3.4.20

CPE	Name	Operator	Version
	total.js	le	3.4.20
	total.js	le	3.4.20

References

github.com/advisories/GHSA-72r3-9fpx-mq44

github.com/totaljs/framework

www.youtube.com/watch?v=E2784z7Bu2c

0.001 Low

EPSS

Percentile

21.4%

JSON

Related for VERACODE:35584