Thexerteproject vulnerabilities
We track 4 vulnerabilities in Thexerteproject products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest Thexerteproject vulnerabilities
- 7.2 High severity
xerteonlinetoolkits: Unrestricted Upload of File with Dangerous Type
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc fil
- 9.8 Critical severity
xerteonlinetoolkits: Incomplete List of Disallowed Inputs
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit
- 7.1 High severity
xerteonlinetoolkits: Improper Limitation of a Pathname to a Restricted Directory
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences.
- 8.6 High severity
xerteonlinetoolkits: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PH