CVE-2019-15953

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.

• CWE-862

• https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdfExploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Sep/6Exploit, Mailing List, Third Party Advisory
• https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdfExploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Sep/6Exploit, Mailing List, Third Party Advisory

Published

Sep 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15947In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data un…7.5
• CVE-2019-15948Texas Instruments CC256x and WL18xx dual-mode Bluetooth cont…8.8
• CVE-2019-15949Nagios XI before 5.6.6 allows remote command execution as ro…8.8
• CVE-2019-1595A vulnerability in the Fibre Channel over Ethernet (FCoE) pr…7.4
• CVE-2019-15950The CRM Plugin before 4.2.4 for Redmine allows XSS via craft…6.1
• CVE-2019-15952An issue was discovered in Total.js CMS 12.0.0. An authentic…
• CVE-2019-15954An issue was discovered in Total.js CMS 12.0.0. An authentic…9.9
• CVE-2019-15955An issue was discovered in Total.js CMS 12.0.0. A low privil…
• CVE-2019-15956A vulnerability in the web management interface of Cisco Asy…8.8
• CVE-2019-15957A vulnerability in the web-based management interface of cer…7.2
• CVE-2019-15958A vulnerability in the REST API of Cisco Prime Infrastructur…9.8
• CVE-2019-15959A vulnerability in Cisco Small Business SPA500 Series IP Pho…6.6