Xerte Online Toolkits versions 3.15 and earlier have multiple security vulnerabilities that can be exploited by unauthenticated attackers.

🔴 CVE-2026-34415 - Critical (9.8) Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attacker... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34415/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34413 - High (8.6) Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die()... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34413/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 EUVD-2026-25067 📊 Score: 8.8/10 (CVSS v3.1) 📦 Product: xerteonlinetoolkits, xerteonlinetoolkits, xerteonlinetoolkits (+3 more) 🏢 Vendor: thexerteproject 📅 Updated: 2026-04-22 📝 Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redi... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25067 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-25073 📊 Score: 6.9/10 (CVSS v3.1) 📦 Product: xerteonlinetoolkits, xerteonlinetoolkits 🏢 Vendor: thexerteproject 📅 Updated: 2026-04-22 📝 Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25073 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-25068 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: xerteonlinetoolkits, xerteonlinetoolkits, xerteonlinetoolkits (+3 more) 🏢 Vendor: thexerteproject 📅 Updated: 2026-04-22 📝 Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name pa... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25068 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-25069 📊 Score: 9.3/10 (CVSS v3.1) 📦 Product: xerteonlinetoolkits, xerteonlinetoolkits, xerteonlinetoolkits (+3 more) 🏢 Vendor: thexerteproject 📅 Updated: 2026-04-22 📝 Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25069 #cybersecurity #infosec #euvd #cve #vulnerability