Skip to content
OpenAdvisories

Vendor

thexerteproject

5 known vulnerabilities.

Products

xerteonlinetoolkits 5
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2026-34413 Public exploit Scanner template

    Xerte Online Toolkits Missing Authentication via connector.php

    Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing P…

    thexerteproject xerteonlinetoolkits
  • Critical 9.8
    CVE-2026-34415 Public exploit

    Xerte Online Toolkits File Upload RCE via elfinder Connector

    Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploi…

    thexerteproject xerteonlinetoolkits
  • High 7.1
    CVE-2026-34414 Public exploit

    Xerte Online Toolkits Path Traversal via connector.php

    Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences.…

    thexerteproject xerteonlinetoolkits
  • Medium 5.3
    CVE-2026-41459 Public exploit

    Xerte Online Toolkits Path Disclosure via /setup

    Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page…

    thexerteproject xerteonlinetoolkits