CVE-2025-11019

LowCVSS 2.4

Published: 26/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability has been found in Total.js CMS (up to version 19.9.0) in an unknown function of the files menu component. The manipulation leads to cross-site scripting (XSS). The attack can be initiated remotely, and the exploit has been publicly disclosed.

Risk Assessment

An attacker can remotely inject malicious JavaScript, potentially leading to data theft or session hijacking. Organizations using Total.js CMS are at risk of XSS attacks.

Recommendation

Update Total.js CMS to the latest version that fixes this vulnerability. If updating is not possible, implement input filtering in the files menu.

Other vulnerabilities in Total.js CMS

CVE-2025-10940Low
In Total.js CMS 1.0.0, the layouts_save function of the Layout Page component in /admin/ is vulnerable to cross-site scripting (XSS) via manipulation of the HTML argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

Original NVD description (English source)

A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS