Unrated severityCISA KEVNVD Advisory· Published Nov 26, 2024· Updated Nov 22, 2025
ProjectSend Unauthenticated Configuration Modification
CVE-2024-11680
Description
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2< r1720+ 1 more
- (no CPE)range: < r1720
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
5- github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744mitrepatch
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yamlmitreexploit
- github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rbmitreexploit
- vulncheck.com/advisories/projectsend-bypassmitrethird-party-advisory
- www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdfmitrethird-party-advisoryexploit
News mentions
0No linked articles in our index yet.