The Xerte Online Tools setup component allows an unauthenticated attacker to trigger a full re‑installation through the /setup/ directory. During that process the attacker can supply a database connection string, causing the application to bind to an arbitrary database under the attacker’s control. This bypasses the normal authentication flow and effectively permits the attacker to execute arbitrary commands on the host server.

The vulnerability affects Xerte Online Tools provided by Xerte. The advisory does not specify a limited set of affected releases, although the vendor’s news page indicates that versions 3.14 and 3.15 contain a corrective change. Precise version compatibility remains administrator‑specific; verify the deployed version and ensure that the /setup/ directory is either removed or otherwise inaccessible after initial configuration.

The flaw carries a CVSS score of 9.1, indicating critical severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV. Attackers can exploit the flaw by sending unauthenticated HTTP requests to the /setup/ endpoint, which may be possible over the internet if the directory is publicly reachable. The lack of authentication or rate limiting on this endpoint eliminates most practical barriers to exploitation.