CVE-2025-10940

LowCVSS 2.4

Published: 25/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

In Total.js CMS 1.0.0, the layouts_save function of the Layout Page component in /admin/ is vulnerable to cross-site scripting (XSS) via manipulation of the HTML argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

Risk Assessment

The risk includes the possibility of injecting malicious scripts remotely, which could lead to session theft, admin account takeover, or website defacement.

Recommendation

It is recommended to apply patches immediately or temporarily disable the layouts_save function, and to validate and sanitize HTML input before saving.

Other vulnerabilities in Total.js CMS

CVE-2025-11019Low
A vulnerability has been found in Total.js CMS (up to version 19.9.0) in an unknown function of the files menu component. The manipulation leads to cross-site scripting (XSS). The attack can be initiated remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS