CVE-2022-30013: Totaljs Total.js

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file.

Affected products

• Totaljs Total.js: version 3.4.5 only

Published 2022-05-16. Last modified 2026-06-17.