VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 7, 2015· Updated May 6, 2026

CVE-2014-9567

CVE-2014-9567

Description

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.

Affected products

15
  • Projectsend/Projectsend15 versions
    cpe:2.3:a:projectsend:projectsend:100:*:*:*:*:*:*:*+ 14 more
    • cpe:2.3:a:projectsend:projectsend:100:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:102:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:105:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:110:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:155:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:156:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:157:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:161:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:180:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:335:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:375:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:405:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:412:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:514:*:*:*:*:*:*:*
    • cpe:2.3:a:projectsend:projectsend:561:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.