https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T02:09:43.300277+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336736 EUVD-2026-336736 2026-10-08T02:09:43.358491+00:00 EUVD-2026-336736 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34414 fkie_cve-2026-34414 2026-10-08T02:09:43.358536+00:00

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.

 https://cve.radiocsirt.org/vuln/ghsa-qmm4-q4hj-r5cm GHSA-qmm4-q4hj-r5cm 2026-10-08T02:09:43.358577+00:00

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.