projectsend File Editor/Custom Download Aliases cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.
Summary
A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version r1945 is recommended to address this issue. Patch name: 334da1ea39cb12f6b6e98dd2f80bb033e0c7b845. It is advisable to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | projectsend | r1720 | r1945 | Patch available | CNA |
- projectsend Vendor— Affected r1720 Fixed in r1945 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* | — | — | ProjectSend |
- cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* Versions — — ·ProjectSend
Remediation
- Fix · CNA projectsend Fixed in r1945
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13232
- 2026-10-03 Alias added: GHSA-462x-7r4x-p5hx
References
Sources
- CVE-2025-13232 · CVE Program
- CVE-2025-13232 · NVD
- FIRST EPSS
- GHSA-462x-7r4x-p5hx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences