Package Instance

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).

Code Injection
The package `total.js` is vulnerable to Remote Code Execution (RCE) via `set`.

Code Injection
The package total.js are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

Path Traversal
`index.js` in Total.js Platform allows path traversal.

Code Injection
Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed

Command Injection
This affects the package `total.js` The issue occurs in the `image.pipe` and `image.stream` functions. The type parameter is used to build the command that is then executed using `child_process.spawn.` The issue occurs because `child_process.spawn` is called with the option shell set to true and because the type parameter is not properly sanitized.

Improperly Controlled Modification of Object Prototype Attributes
The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.