CVE-2022-30013

A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file.

• CWE-79

• https://github.com/totaljs/frameworkProduct, Third Party Advisory
• https://www.youtube.com/watch?v=E2784z7Bu2cExploit, Third Party Advisory
• https://github.com/totaljs/frameworkProduct, Third Party Advisory
• https://www.youtube.com/watch?v=E2784z7Bu2cExploit, Third Party Advisory

Published

May 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30003Sourcecodester Online Market Place Site 1.0 is vulnerable to…5.4
• CVE-2022-30004Sourcecodester Online Market Place Site v1.0 suffers from an…9.8
• CVE-2022-30007GXCMS V1.5 has a file upload vulnerability in the background…7.2
• CVE-2022-3001This vulnerability exists in Milesight Video Management Syst…7.5
• CVE-2022-30011In HMS 1.0 when requesting appointment.php through POST, mul…9.8
• CVE-2022-30012In the POST request of the appointment.php page of HMS v.0, …7.5
• CVE-2022-30014Lumidek Associates Simple Food Website 1.0 is vulnerable to …8.8
• CVE-2022-30015In Simple Food Website 1.0, a moderation can put the Cross S…5.4
• CVE-2022-30016Rescue Dispatch Management System 1.0 is vulnerable to Incor…8.8
• CVE-2022-30017Rescue Dispatch Management System 1.0 suffers from Stored XS…5.4
• CVE-2022-30018Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficie…8.8
• CVE-2022-3002Cross-site Scripting (XSS) - Stored in GitHub repository yet…5.4