Xerte Online Toolkits (Through 3.15.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xerte-online-toolkits-through-3.15.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 08:26:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXerte Online Toolkits: Authenticated remote code execution (CVE-2026-117607)https://feed.craftedsignal.io/briefs/2026-10-xerte-rce/Wed, 28 Oct 2026 08:26:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-xerte-rce/Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack.Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability. Authenticated users with system permissions can run PHP code by importing a crafted language pack. Attackers can upload a ZIP file via import_language.php containing a .inc file and request it through the language parameter to execute code on the server.

]]>highadvisory