← Vulnerability feed

Vulnerability record · CVE-2019-15953 · published 5 September 2019

CVE-2019-15953: Totaljs total.js cms missing authorization vulnerability

Totaljs · Total.Js Cms

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.

8.8 CVSS 3.0 High EPSS 1.5% · top 26.0% CWE-862 · Missing authorization
8.8CVSS 3.0 base score, v2 6.5
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf ExploitThird Party Advisory
https://seclists.org/fulldisclosure/2019/Sep/6 ExploitMailing ListThird Party Advisory
https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf ExploitThird Party Advisory
https://seclists.org/fulldisclosure/2019/Sep/6 ExploitMailing ListThird Party Advisory

Track CVE-2019-15953 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2019-15954Total.js CMS widget tag sandbox escape leads to RCETotal.js CMS 12.0.0 evaluates widget tag content server side, and an authenticated user holding the widgets privilege can escape the sandbox object w…EPSS 79%analysed8.8CVE-2019-15952Totaljs total.js cms path traversal vulnerabilityAn issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .…EPSS 5.1%7.5CVE-2020-9381Totaljs total.js cms incorrect authorization vulnerabilitycontrollers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be expl…EPSS 2.1%6.5CVE-2019-15955Totaljs total.js cms broken cryptographic algorithm vulnerabilityAn issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values insi…EPSS 0.87%6.1CVE-2019-10260Totaljs total.js cms cross-site scripting vulnerabilityTotal.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).EPSS 0.91%9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed7.8CVE-2022-0492Linux kernel cgroups v1 release_agent privilege escalation and container escapeThe Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be …KEVEPSS 5.5%analysed9.9CVE-2024-57726SimpleHelp missing authorization lets low-privilege technicians escalate to adminSimpleHelp remote support software v5.5.7 and earlier fails to properly authorize API key creation, allowing low-privilege technicians to mint API ke…KEVEPSS 67%analysed

Source: NIST National Vulnerability Database (record CVE-2019-15953), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.