CVE-2022-41392

A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute...

5.4 Medium

CVE-2022-41392 is a medium vulnerability (CVSS 5.4) in Totaljs Total.js, published October 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. No source names a fixed version.

A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.87%Unchanged since Oct 8, 2022

What each source reports

NVD Score used 5.4

Record: CVE-2022-41392
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2022-41392
Updated: 2026-11-02

EUVDEUVD-2022-44587 No score

Record: EUVD-2022-44587
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6c4g-j5rf-mc73 5.4

A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute...

Record: GHSA-6c4g-j5rf-mc73
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

totaljs total.js

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD