xerteonlinetoolkits-rce

Xerte Online Toolkits = 3.15 Remote Code Execution Xerte Online Toolkits versions 3.15 and earlier suffer from 3 vulnerabilities in the /editor/elfinder/php/connector.php component, which may be chained together by an unauthenticated attacker to achieve Remote Code Execution RCE. Affected Version...

Malicious Package

Overview polygon-toolkits-validator is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

MAL-2026-16087 Malicious code in polygon-toolkits-validator (npm)

[email protected] exports Node crypto helper wrappers, but validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as action: "validator", content: btoainput through checkvalidator in dist/index.js, then returns true without validating...

Malicious code in polygon-toolkits-validator (npm)

[email protected] exports Node crypto helper wrappers, but validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as action: "validator", content: btoainput through checkvalidator in dist/index.js, then returns true without validating...

cve-2026-3437

cve-2026-3437 portwell.sys Portwell Engineering Toolkits v4.8.2 में MmMapIoSpace के माध्यम से मनमाना भौतिक मेमोरी रीड/राइट। ड्राइवर के IOCTL इंटरफ़ेस के साथ इंटरैक्ट करके LPE/SYSTEM एस्केलेशन और BYOVD को सक्षम बनाता है। विश्लेषण ड्राइवर IRPMJDEVICECONTROL के लिए एक डिस्पैच रूटीन पंजीकृत करता है...

Xerte Online Toolkit contains an authentication bypass that allows for RCE

Overview Two vulnerabilities have been discovered in Xerte Online Toolkits, an open-source e-learning authoring toolsuite intended for the creation of learning materials within a web browser. CVE-2026-14261 tracks the persistence of the /setup/ directory after installation, which allows an...

dataops-toolkits (>=0.1.1, <=0.1.2), rm-gallery (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-22033 via label-studio (>=1.5.0, <=1.17.0)

label-studio PYPI version =1.5.0, =0.1.1, =0.1.0, =0.1.2 Source cves: CVE-2026-22033 Source advisory: OSV:PYSEC-2026-1502...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25297 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25297 Source advisory: OSV:PYSEC-2026-1503...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25296 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25296 Source advisory: OSV:PYSEC-2026-1504...

📄 Xerte Online Toolkits 3.15 Unauthenticated Remote Code Execution

Python remote code execution proof of concept exploit for Xerte Online Toolkits targeting multiple vulnerabilities in the elFinder file manager integration. ================================================================================================================================== | Title :...

📄 Xerte Online Toolkits 3.15 Shell Upload

This Metasploit module bypasses authentication failure, extension blacklist, and path traversal vulnerabilities in the /editor/elfinder/php/connector.php endpoint to upload and execute a shell in Xerte Online Toolkits versions 3.15 commit 4e40f8030a2e3267267db7ce03e0ff57270be6f5 as there are no...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Portwell Engineering_Toolkits

No d...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2022-32179 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2022-32179 Source advisory: MEND:CVE-2022-32179...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2022-32178 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2022-32178 Source advisory: MEND:CVE-2022-32178...

CVE-2026-34414

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value...

CVE-2026-41459

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value...

EUVD-2026-25073

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value...

EUVD-2026-25068

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value...

EUVD-2026-25069

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authenticati...

EUVD-2026-25067

Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit or die, allowing PHP execution to continue and process the...