Projectsend
by Projectsend
Source repositories
CVEs (36)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-11680 | Cri | 0.86 | 9.8 | 0.92 | KEV | Nov 26, 2024 | ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration.… | |
| CVE-2023-53980 | Cri | 0.64 | 9.8 | 0.01 | Dec 22, 2025 | ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on… | ||
| CVE-2021-40887 | Cri | 0.64 | 9.8 | 0.02 | Oct 11, 2021 | Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder. | ||
| CVE-2016-10734 | Cri | 0.64 | 9.8 | 0.02 | Oct 29, 2018 | ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php. | ||
| CVE-2016-10733 | Cri | 0.64 | 9.8 | 0.02 | Oct 29, 2018 | ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. | ||
| CVE-2016-10732 | Cri | 0.64 | 9.8 | 0.02 | Oct 29, 2018 | ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php. | ||
| CVE-2016-10731 | Cri | 0.64 | 9.8 | 0.01 | Oct 29, 2018 | ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status,… | ||
| CVE-2017-9741 | Cri | 0.64 | 9.8 | 0.02 | Jun 18, 2017 | install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file. | ||
| CVE-2018-7201 | Hig | 0.57 | 8.8 | 0.01 | May 22, 2019 | CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. | ||
| CVE-2019-11378 | Hig | 0.57 | 8.8 | 0.04 | Apr 20, 2019 | An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run… | ||
| CVE-2021-40884 | Hig | 0.53 | 8.1 | 0.01 | Oct 11, 2021 | Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application. | ||
| CVE-2023-53905 | Hig | 0.52 | 8.0 | 0.00 | Dec 17, 2025 | ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV… | ||
| CVE-2023-53930 | Hig | 0.49 | 7.5 | 0.00 | Dec 17, 2025 | ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download… | ||
| CVE-2020-28874 | Hig | 0.49 | 7.5 | 0.02 | Jan 26, 2021 | reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter). | ||
| CVE-2019-11492 | Hig | 0.49 | 7.5 | 0.01 | Apr 26, 2019 | ProjectSend before r1070 writes user passwords to the server logs. | ||
| CVE-2021-47947 | Med | 0.42 | 6.4 | 0.00 | May 10, 2026 | Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that… | ||
| CVE-2021-40886 | Med | 0.42 | 6.5 | 0.01 | Oct 11, 2021 | Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization. | ||
| CVE-2026-3977 | Med | 0.41 | 6.3 | 0.00 | Mar 12, 2026 | A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is… | ||
| CVE-2018-7202 | Med | 0.40 | 6.1 | 0.01 | May 22, 2019 | An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page. | ||
| CVE-2019-11533 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2019 | Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML. |
- risk 0.86cvss 9.8epss 0.92
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration.…
- risk 0.64cvss 9.8epss 0.01
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on…
- risk 0.64cvss 9.8epss 0.02
Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.
- risk 0.64cvss 9.8epss 0.02
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
- risk 0.64cvss 9.8epss 0.02
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
- risk 0.64cvss 9.8epss 0.02
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
- risk 0.64cvss 9.8epss 0.01
ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status,…
- risk 0.64cvss 9.8epss 0.02
install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.
- risk 0.57cvss 8.8epss 0.01
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
- risk 0.57cvss 8.8epss 0.04
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run…
- risk 0.53cvss 8.1epss 0.01
Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.
- risk 0.52cvss 8.0epss 0.00
ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV…
- risk 0.49cvss 7.5epss 0.00
ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download…
- risk 0.49cvss 7.5epss 0.02
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
- risk 0.49cvss 7.5epss 0.01
ProjectSend before r1070 writes user passwords to the server logs.
- risk 0.42cvss 6.4epss 0.00
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that…
- risk 0.42cvss 6.5epss 0.01
Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.
- risk 0.41cvss 6.3epss 0.00
A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.
Page 1 of 2