ProjectSend

Records35All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

ProjectSend records in CISA KEV

TI-2024-10826 ProjectSend Improper Authentication Vulnerability CRITICAL 100KEV 2024-12-03

Components

Products in the NVD configurations · select one to filter the records

Projectsend 29 records CRITICAL

Records

29 records in Projectsend · all components

TI-2024-10826 CVE-2024-11680 · GHSA-755x-386x-p26p

ProjectSend Unauthenticated Configuration Modification

CRITICAL 100KEV

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.91849 Published 2024-11-26 Fixed in r1720 CWE-306

TI-2023-30263 CVE-2023-53980 · GHSA-9wx9-rprp-6rxh

ProjectSend r1605 Remote Code Execution via File Extension Manipulation

HIGH 73

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00946 Published 2025-12-22 No fix listed CWE-434

TI-2023-30213 CVE-2023-53930 · GHSA-gc6r-xc3x-9vvg

ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability

MEDIUM 64

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00383 Published 2025-12-17 No fix listed CWE-639

TI-2014-07764 CVE-2014-9567 · GHSA-9wrg-v9p9-p326

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly…

MEDIUM 62

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.4334 Published 2015-01-07 No fix listed CWE-94

TI-2023-30188 CVE-2023-53905 · GHSA-qpqq-223w-7pwh

ProjectSend r1605 CSV Injection via User Account Export Functionality

MEDIUM 61

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00502 Published 2025-12-17 No fix listed CWE-1236

TI-2017-14167 CVE-2017-20101 · GHSA-hj37-32jp-79fv

ProjectSend information disclosure

MEDIUM 59

A vulnerability, which was classified as problematic, was found in ProjectSend r754.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0114 Published 2022-06-27 No fix listed CWE-200

TI-2023-00574 CVE-2023-0607 · GHSA-crvg-xv76-f4pq

Cross-site Scripting (XSS) - Stored in projectsend/projectsend

MEDIUM 57

Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00682 Published 2023-02-01 Fixed in r1606 CWE-79

TI-2023-30189 CVE-2023-53906 · GHSA-h6qj-492w-fjwr

ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page

MEDIUM 56

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00314 Published 2025-12-17 No fix listed CWE-79

TI-2021-17802 CVE-2021-40887 · GHSA-x5xx-j968-8f6j

Projectsend version r1295 is affected by a directory traversal vulnerability.

MEDIUM 47

Projectsend version r1295 is affected by a directory traversal vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0237 Published 2021-10-11 No fix listed CWE-22

TI-2016-08773 CVE-2016-10733 · GHSA-jph2-x4qr-27hc

ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.

MEDIUM 46

ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02131 Published 2018-10-28 No fix listed CWE-22

TI-2016-08772 CVE-2016-10732 · GHSA-hm27-52j9-pwgj

ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for…

MEDIUM 46

ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01855 Published 2018-10-28 No fix listed CWE-287

TI-2017-07125 CVE-2017-9741 · GHSA-jwv9-639x-pfg4

install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary…

MEDIUM 45

install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01556 Published 2017-06-18 No fix listed CWE-20

TI-2016-08774 CVE-2016-10734 · GHSA-cqm5-ff3v-7m4w

ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

MEDIUM 45

ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01545 Published 2018-10-28 No fix listed CWE-285

TI-2016-08771 CVE-2016-10731 · GHSA-w6f6-j3xw-wh45

ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the…

MEDIUM 45

ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, cl…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01421 Published 2018-10-28 No fix listed CWE-89

TI-2019-08500 CVE-2019-11378 · GHSA-fggw-5hv2-58cq

An issue was discovered in ProjectSend r1053.

MEDIUM 44

An issue was discovered in ProjectSend r1053.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.03578 Published 2019-04-20 No fix listed CWE-22

TI-2018-05218 CVE-2018-7201 · GHSA-xw67-vhv2-m2p4

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.

MEDIUM 41

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01292 Published 2019-05-22 No fix listed CWE-1236

TI-2024-07097 CVE-2024-7658 · GHSA-4wjp-4mm4-3wrh

projectsend process.php get_preview resource injection

LOW 38

A vulnerability, which was classified as problematic, has been found in projectsend up to r1605.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00791 Published 2024-08-11 No fix listed CWE-99

TI-2021-17800 CVE-2021-40884 · GHSA-5mrg-pm7p-g34v

Projectsend version r1295 is affected by sensitive information disclosure.

LOW 37

Projectsend version r1295 is affected by sensitive information disclosure.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00954 Published 2021-10-11 No fix listed CWE-862

TI-2020-17426 CVE-2020-28874 · GHSA-g5ww-gvff-fp7p

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a…

LOW 37

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02379 Published 2021-01-21 No fix listed CWE-287

TI-2019-08583 CVE-2019-11492 · GHSA-j72j-hjpx-v29v

ProjectSend before r1070 writes user passwords to the server logs.

LOW 35

ProjectSend before r1070 writes user passwords to the server logs.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2019-04-26 No fix listed CWE-532

TI-2015-02253 CVE-2015-2564 · GHSA-p6mv-98h5-3r5j

SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows…

LOW 34

SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.03103 Published 2015-03-20 No fix listed CWE-89

TI-2021-17801 CVE-2021-40886 · GHSA-pfmf-m8rf-gm39

Projectsend version r1295 is affected by a directory traversal vulnerability.

LOW 32

Projectsend version r1295 is affected by a directory traversal vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01419 Published 2021-10-11 No fix listed CWE-22

TI-2019-08616 CVE-2019-11533 · GHSA-m98m-xvj6-94rg

Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote…

LOW 30

Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01186 Published 2019-04-26 No fix listed CWE-79

TI-2024-07098 CVE-2024-7659 · GHSA-255h-xw34-5qmq

projectsend Password Reset Token functions.php generate_random_string random values

LOW 29

A vulnerability, which was classified as problematic, was found in projectsend up to r1605.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00786 Published 2024-08-11 No fix listed CWE-330

TI-2018-05219 CVE-2018-7202 · GHSA-9mj4-mpr8-9p4h

An issue was discovered in ProjectSend before r1053.

LOW 29

An issue was discovered in ProjectSend before r1053.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00802 Published 2019-05-22 No fix listed CWE-79

Open these records in search →