Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Oct 12, 2025A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924.CVE-2025-11655 · Other software · Total.js · reported by VulDBLow 2
A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the component SVG File Handler. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A vulnerability has been found in Total.js CMS up to 19.9.0.CVE-2025-11019 · Other software · Total.js · reported by VulDBLow 1.9
A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was found in Total.js CMS 1.0.0.CVE-2025-10940 · Other software · Total.js · reported by VulDBLow 1.9
A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.CVE-2024-48655 · Other software · totaljs · reported by MITREHigh 8.8
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.
- Product
- total.js_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2022In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.CVE-2022-44019 · Other software · Totaljs · reported by MITREHigh 8.8
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comedoardoottavianelli.it
Oct 7, 2022A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2022-41392 · Other software · Totaljs · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comedoardoottavianelli.it
May 16, 2022A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScriptCVE-2022-30013 · Other software · Totaljs · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET CVE-2021-32831 · Other software · totaljs · reported by GitHubHigh 7.5
Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.CVE-2021-23389 · Other software · Totaljs · reported by report@snyk.ioCritical 9.8
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2021The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.CVE-2021-23344 · Other software · Totaljs · reported by report@snyk.ioCritical 9.8
The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2021This affects the package total.js before 3.4.7.CVE-2020-28495 · Other software · Totaljs · reported by report@snyk.ioHigh 7.3
This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.totaljs.comgithub.com
Feb 2, 2021This affects the package total.js before 3.4.7.CVE-2020-28494 · Other software · Totaljs · reported by report@snyk.ioHigh 8.6
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2020controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI.CVE-2020-9381 · Other software · Totaljs · reported by MITREHigh 7.5
controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.
- Product
- Total.js CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2019An issue was discovered in Total.js CMS 12.0.0.CVE-2019-15955 · Other software · Totaljs · reported by MITREMedium 6.5
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead of O(n)=n^x complexity, and steal the admin password.
- Product
- Total.js CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Sep 5, 2019An issue was discovered in Total.js CMS 12.0.0.CVE-2019-15954 · Other software · Totaljs · reported by MITRECritical 9.9
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>
- Product
- Total.js CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 5, 2019An issue was discovered in Total.js CMS 12.0.0.CVE-2019-15953 · Other software · Totaljs · reported by MITREHigh 8.8
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.
- Product
- Total.js CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Sep 5, 2019An issue was discovered in Total.js CMS 12.0.0.CVE-2019-15952 · Other software · Totaljs · reported by MITREHigh 8.8
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .html files that are outside the permitted directory. Also, if a page contains a template directive, then the directive will be server side processed. Thus, if a user can control the content of a .html file, then they can inject a payload with a malicious template directive to gain Remote Command Execution. The exploit will work only with the .html extension.
- Product
- Total.js CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 28, 2019Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).CVE-2019-10260 · Other software · Totaljs · reported by MITREMedium 6.1
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
- Product
- Total.js CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2019index.js in Total.js Platform before 3.2.3 allows path traversal.CVE-2019-8903 · Other software · Totaljs · reported by MITREHigh 7.5
index.js in Total.js Platform before 3.2.3 allows path traversal.
- Product
- Total.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.certimetergroup.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.