Moderate severity vulnerability that affects total.js

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-10260 · ADVISORY
• totaljs/cms commit 75205f9 · WEB
• totaljs/cms commit 8b9d7da · WEB
• GitHub Advisory GHSA-72p5-2r6g-fm6v · ADVISORY

More vulnerabilities in total.js cms

• CVE-2020-9381HIGH 7.5controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This ca…
• CVE-2019-15955MEDIUM 6.5An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random va…
• CVE-2019-15954CRITICAL 9.9An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (…
• CVE-2019-15953HIGH 8.8An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not …
• CVE-2019-15952HIGH 8.8An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to …