CVE-2020-9381

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI

published February 24, 2020

CVSS
—
EPSS
2%
Percentile
81.7
In the wild
Unconfirmed
What it is

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02114 · 81.7th percentile
Published
2020-02-24T21:25Z
EPSS history
Timeline
  • 24 FEB 21:25Z
    controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI
    cvelistv5