TI-2023-00574 Aliases CVE-2023-0607 GHSA-crvg-xv76-f4pq

Cross-site Scripting (XSS) - Stored in projectsend/projectsend

MEDIUM 57CWE-79Published 2023-02-01 · Updated 2025-03-27

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00682 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed projectsend/projectsend (projectsend): r1606

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ProjectSend	projectsend/projectsend	before r1606	r1606	Patch available	CNA

projectsend/projectsend VendorProjectSend Affected before r1606 Fixed in r1606 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:projectsend:projectsend::::::::	before r1606	Vulnerable	ProjectSend

cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* Versions before r1606 Vulnerable ·ProjectSend

Remediation

Fix · CNA projectsend/projectsend (projectsend) Fixed in r1606

Timeline

2026-10-02 Threatist record created from CVE-2023-0607
2026-10-03 Alias added: GHSA-crvg-xv76-f4pq

References

Exploit 1

https://huntr.dev/bounties/9294743d-7818-4264-b973-59de027d549b

Patch 1

https://github.com/projectsend/projectsend/commit/698be4ade1db6ae0eaf27c843a03ffc9683cca0a

TI-2024-10826 ProjectSend Unauthenticated Configuration Modification KEVCVSS 3.1CRITICAL 9.8
TI-2023-30263 ProjectSend r1605 Remote Code Execution via File Extension Manipulation CVSS 4.0HIGH 8.7
TI-2023-30213 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability CVSS 4.0HIGH 7.1
TI-2014-07764 Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly… CVSS 2.0HIGH 7.5
TI-2023-30188 ProjectSend r1605 CSV Injection via User Account Export Functionality CVSS 4.0MEDIUM 6.2
TI-2017-14167 ProjectSend information disclosure CVSS 3.1MEDIUM 5.7

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences