CVE-2019-15954

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>

• CWE-862

• http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdfExploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Sep/5Exploit, Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdfExploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Sep/5Exploit, Mailing List, Third Party Advisory

Published

Sep 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15948Texas Instruments CC256x and WL18xx dual-mode Bluetooth cont…8.8
• CVE-2019-15949Nagios XI before 5.6.6 allows remote command execution as ro…8.8
• CVE-2019-1595A vulnerability in the Fibre Channel over Ethernet (FCoE) pr…7.4
• CVE-2019-15950The CRM Plugin before 4.2.4 for Redmine allows XSS via craft…6.1
• CVE-2019-15952An issue was discovered in Total.js CMS 12.0.0. An authentic…
• CVE-2019-15953An issue was discovered in Total.js CMS 12.0.0. An authentic…
• CVE-2019-15955An issue was discovered in Total.js CMS 12.0.0. A low privil…
• CVE-2019-15956A vulnerability in the web management interface of Cisco Asy…8.8
• CVE-2019-15957A vulnerability in the web-based management interface of cer…7.2
• CVE-2019-15958A vulnerability in the REST API of Cisco Prime Infrastructur…9.8
• CVE-2019-15959A vulnerability in Cisco Small Business SPA500 Series IP Pho…6.6
• CVE-2019-1596A vulnerability in the Bash shell implementation for Cisco N…7.8