CVE-2025-11019

MediumCVSS 4.8/10Last modified Oct 9, 2026

Description

A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
Total.js	CMS	19.0; 19.1; 19.2; 19.3; 19.4; 19.5; 19.6; 19.7; 19.8; 19.9.0

References

https://vuldb.com/?ctiid.325962Permissions Required, VDB Entry
https://vuldb.com/?id.325962Third Party Advisory, VDB Entry
https://vuldb.com/?submit.651427Third Party Advisory, VDB Entry

Timeline

Published: Sep 26, 2025
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-11027.1A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticat CVE-2025-110208.8An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted CVE-2025-110217.5A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communic CVE-2025-110229.6Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery. This CSRF vulnerability r CVE-2025-110239.8Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Re CVE-2025-110249.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies CVE-2025-110255.3Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Me CVE-2025-110267.5A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Co CVE-2025-110275.4A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File CVE-2025-110287.5A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing m CVE-2025-110298.8A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cr CVE-2025-11036.5A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blackli