Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: thexerteproject Clear all filters
TI-2026-81652 CVE-2026-117607 · GHSA-w4qr-gppq-v53c

Remote code execution in Xerte Online Toolkits via language pack import

Priority HIGH 72

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00684 Published 2026-10-28 No fix listed CWE-434
TI-2026-26694 CVE-2026-34413 · GHSA-g35c-vgp7-f8qm

Xerte Online Toolkits Missing Authentication via connector.php

Priority MEDIUM 50

Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers do…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0311 Published 2026-04-22 No fix listed CWE-497
TI-2026-26696 CVE-2026-34415 · GHSA-67j3-r63p-59hf

Xerte Online Toolkits File Upload RCE via elfinder Connector

Priority MEDIUM 48

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex patter…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03575 Published 2026-04-22 No fix listed CWE-184
TI-2026-26695 CVE-2026-34414 · GHSA-qmm4-q4hj-r5cm

Xerte Online Toolkits Path Traversal via connector.php

Priority MEDIUM 64

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.02826 Published 2026-04-22 No fix listed CWE-22
TI-2026-30048 CVE-2026-41459 · GHSA-53wm-fw97-q62h

Xerte Online Toolkits Path Disclosure via /setup

Priority LOW 38

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00801 Published 2026-04-22 Fixed CWE-497