Xerte vulnerabilities
5 vulnerabilities
Known vulnerabilities in Xerte products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Xerte2 vulnerabilities
- Xerte Online Tools2 vulnerabilities
- Xerte Online Toolkits1 vulnerabilities
CVE-2021-44664xertexerte
EPSS score12.78%
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.CVE-2021-44665xertexerteEPSS score7.69%
A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php.CVE-2026-14261xertexerte online toolsEPSS score1.03%
A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.CVE-2026-32985apereoxerte_online_toolkits+1EPSS score2.00%
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.CVE-2026-12116xertexerte online toolsEPSS score0.70%
A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed.