Total
29 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-11680 | 1 Projectsend | 1 Projectsend | 2026-07-14 | N/A | 9.8 CRITICAL |
| ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. | |||||
| CVE-2020-28874 | 1 Projectsend | 1 Projectsend | 2026-07-09 | 5.0 MEDIUM | 7.5 HIGH |
| reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter). | |||||
| CVE-2024-7659 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 2.6 LOW | 3.7 LOW |
| A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component. | |||||
| CVE-2024-7658 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component. | |||||
| CVE-2023-53980 | 1 Projectsend | 1 Projectsend | 2026-06-17 | N/A | 9.8 CRITICAL |
| ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server. | |||||
| CVE-2023-53930 | 1 Projectsend | 1 Projectsend | 2026-06-17 | N/A | 7.5 HIGH |
| ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php. | |||||
| CVE-2023-53906 | 1 Projectsend | 1 Projectsend | 2026-06-17 | N/A | 4.8 MEDIUM |
| projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection. | |||||
| CVE-2023-53905 | 1 Projectsend | 1 Projectsend | 2026-06-17 | N/A | 8.0 HIGH |
| ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files. | |||||
| CVE-2023-0607 | 1 Projectsend | 1 Projectsend | 2026-06-17 | N/A | 4.8 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606. | |||||
| CVE-2021-40888 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code. | |||||
| CVE-2021-40887 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder. | |||||
| CVE-2021-40886 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization. | |||||
| CVE-2021-40884 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 5.5 MEDIUM | 8.1 HIGH |
| Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application. | |||||
| CVE-2019-11533 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML. | |||||
| CVE-2019-11492 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| ProjectSend before r1070 writes user passwords to the server logs. | |||||
| CVE-2019-11378 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code. | |||||
| CVE-2018-7202 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page. | |||||
| CVE-2018-7201 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. | |||||
| CVE-2017-9786 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php. | |||||
| CVE-2017-9783 | 1 Projectsend | 1 Projectsend | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated. | |||||