CVE-2025-10940

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-10940
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10940.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-10940
Published
2025-09-25T10:32:05Z
Modified
2026-08-12T03:51:11Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Total.js CMS Layout admin layouts_save cross site scripting
Details

A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10940.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "last_affected": "1.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/totaljs/framework

Affected ranges

Type
GIT
Repo
https://github.com/totaljs/framework
Events
Introduced
5a6b6e806078ae7292af46182d41fc418e5e4461
Last Affected
5a6b6e806078ae7292af46182d41fc418e5e4461
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:totaljs:total.js:1.0.0:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*
1.0.0
v1.*
v1.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10940.json"