Xerte Online Toolkits versions up to 3.15.5 contain a remote code execution vulnerability. Authenticated users with system permissions can exploit this flaw by importing a specially crafted language pack ZIP file containing a .inc file. This file can then be accessed via the language parameter to execute arbitrary PHP code on the server, leading to full compromise.