Approved changes feed: RSS · Atom
cpe:2.3:a:totaljs:total.js:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | Totaljs (c2c15978-184c-5682-8600-bc2601bf8f6a) |
|---|---|
| Product | Total.Js (0e4ab704-0baa-5f02-acde-2ae0b0f53c67) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-11019 |
vulnerable | 2026-06-08 07:02:27.935297 |
Total.js CMS Files Menu cross site scripting
LOW (2.4)
A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2025-09-26T14:32:07.098Z
Updated: 2025-09-26T15:01:48.580Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-44019 |
vulnerable | 2026-06-08 05:49:35.245352 |
Details available
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.
Published: 2022-10-29T00:00:00.000Z
Updated: 2025-05-07T13:58:14.770Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32831 |
vulnerable | 2026-06-08 05:32:08.130599 |
Code injection in total.js
HIGH (7.5)
Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
Published: 2021-08-30T20:40:21.000Z
Updated: 2024-08-03T23:33:56.088Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-23389 |
vulnerable | 2026-06-08 05:30:02.841170 |
Arbitrary Code Execution
CRITICAL (9.8)
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Published: 2021-07-12T15:15:18.459Z
Updated: 2024-09-16T18:33:56.688Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-23344 |
vulnerable | 2026-06-08 05:30:02.744210 |
Remote Code Execution (RCE)
CRITICAL (9.8)
The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
Published: 2021-03-04T16:55:14.189Z
Updated: 2024-09-17T01:55:53.280Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28495 |
vulnerable | 2026-06-08 05:23:56.174215 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28494 |
vulnerable | 2026-06-08 05:23:56.173436 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-8903 |
vulnerable | 2026-06-08 05:14:24.648022 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.