Medium severity4.8OSV Advisory· Published Dec 17, 2025· Updated Jun 17, 2026
CVE-2023-53906
CVE-2023-53906
Description
projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Stable, r1053, r1070, …+ 2 more
- (no CPE)range: Stable, r1053, r1070, …
- cpe:2.3:a:projectsend:projectsend:r1605:*:*:*:*:*:*:*
- (no CPE)range: r1605
Patches
Vulnerability mechanics
References
3- www.exploit-db.com/exploits/51518nvdExploitThird Party Advisory
- www.vulncheck.com/advisories/projectsend-stored-cross-site-scripting-via-custom-assets-pagenvdExploitThird Party Advisory
- www.projectsend.orgnvdProduct
News mentions
0No linked articles in our index yet.