Vulnerabilities

TI-2023-30263 CVE-2023-53980 · GHSA-9wx9-rprp-6rxh

ProjectSend r1605 Remote Code Execution via File Extension Manipulation

HIGH 73

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00946 Published 2025-12-22 No fix listed CWE-434

TI-2023-30213 CVE-2023-53930 · GHSA-gc6r-xc3x-9vvg

ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability

MEDIUM 64

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00383 Published 2025-12-17 No fix listed CWE-639

TI-2023-30189 CVE-2023-53906 · GHSA-h6qj-492w-fjwr

ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page

MEDIUM 56

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00314 Published 2025-12-17 No fix listed CWE-79

TI-2023-30188 CVE-2023-53905 · GHSA-qpqq-223w-7pwh

ProjectSend r1605 CSV Injection via User Account Export Functionality

MEDIUM 61

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00502 Published 2025-12-17 No fix listed CWE-1236

TI-2024-10826 CVE-2024-11680 · GHSA-755x-386x-p26p

ProjectSend Unauthenticated Configuration Modification

CRITICAL 100KEV

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.91849 Published 2024-11-26 Fixed in r1720 CWE-306

TI-2024-07098 CVE-2024-7659 · GHSA-255h-xw34-5qmq

projectsend Password Reset Token functions.php generate_random_string random values

LOW 29

A vulnerability, which was classified as problematic, was found in projectsend up to r1605.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00786 Published 2024-08-11 No fix listed CWE-330

TI-2024-07097 CVE-2024-7658 · GHSA-4wjp-4mm4-3wrh

projectsend process.php get_preview resource injection

LOW 38

A vulnerability, which was classified as problematic, has been found in projectsend up to r1605.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00791 Published 2024-08-11 No fix listed CWE-99

TI-2023-00574 CVE-2023-0607 · GHSA-crvg-xv76-f4pq

Cross-site Scripting (XSS) - Stored in projectsend/projectsend

MEDIUM 57

Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00682 Published 2023-02-01 Fixed in r1606 CWE-79

TI-2017-14167 CVE-2017-20101 · GHSA-hj37-32jp-79fv

ProjectSend information disclosure

MEDIUM 59

A vulnerability, which was classified as problematic, was found in ProjectSend r754.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0114 Published 2022-06-27 No fix listed CWE-200

TI-2021-17800 CVE-2021-40884 · GHSA-5mrg-pm7p-g34v

Projectsend version r1295 is affected by sensitive information disclosure.

LOW 37

Projectsend version r1295 is affected by sensitive information disclosure.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00954 Published 2021-10-11 No fix listed CWE-862

TI-2021-17801 CVE-2021-40886 · GHSA-pfmf-m8rf-gm39

Projectsend version r1295 is affected by a directory traversal vulnerability.

LOW 32

Projectsend version r1295 is affected by a directory traversal vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01419 Published 2021-10-11 No fix listed CWE-22

TI-2021-17802 CVE-2021-40887 · GHSA-x5xx-j968-8f6j

Projectsend version r1295 is affected by a directory traversal vulnerability.

MEDIUM 47

Projectsend version r1295 is affected by a directory traversal vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0237 Published 2021-10-11 No fix listed CWE-22

TI-2021-17803 CVE-2021-40888 · GHSA-353r-v23w-mmff

Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of…

LOW 25

Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00644 Published 2021-10-11 No fix listed CWE-79

TI-2020-17426 CVE-2020-28874 · GHSA-g5ww-gvff-fp7p

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a…

LOW 37

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02379 Published 2021-01-21 No fix listed CWE-287

TI-2018-05218 CVE-2018-7201 · GHSA-xw67-vhv2-m2p4

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.

MEDIUM 41

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01292 Published 2019-05-22 No fix listed CWE-1236

TI-2018-05219 CVE-2018-7202 · GHSA-9mj4-mpr8-9p4h

An issue was discovered in ProjectSend before r1053.

LOW 29

An issue was discovered in ProjectSend before r1053.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00802 Published 2019-05-22 No fix listed CWE-79

TI-2019-08616 CVE-2019-11533 · GHSA-m98m-xvj6-94rg

Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote…

LOW 30

Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01186 Published 2019-04-26 No fix listed CWE-79

TI-2019-08583 CVE-2019-11492 · GHSA-j72j-hjpx-v29v

ProjectSend before r1070 writes user passwords to the server logs.

LOW 35

ProjectSend before r1070 writes user passwords to the server logs.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2019-04-26 No fix listed CWE-532

TI-2019-08500 CVE-2019-11378 · GHSA-fggw-5hv2-58cq

An issue was discovered in ProjectSend r1053.

MEDIUM 44

An issue was discovered in ProjectSend r1053.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.03578 Published 2019-04-20 No fix listed CWE-22

TI-2016-08774 CVE-2016-10734 · GHSA-cqm5-ff3v-7m4w

ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

MEDIUM 45

ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01545 Published 2018-10-28 No fix listed CWE-285

TI-2016-08773 CVE-2016-10733 · GHSA-jph2-x4qr-27hc

ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.

MEDIUM 46

ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02131 Published 2018-10-28 No fix listed CWE-22

TI-2016-08772 CVE-2016-10732 · GHSA-hm27-52j9-pwgj

ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for…

MEDIUM 46

ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01855 Published 2018-10-28 No fix listed CWE-287

TI-2016-08771 CVE-2016-10731 · GHSA-w6f6-j3xw-wh45

ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the…

MEDIUM 45

ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, cl…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01421 Published 2018-10-28 No fix listed CWE-89

TI-2017-07166 CVE-2017-9786 · GHSA-cv26-6r64-mxfv

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit…

LOW 29

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in M…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01042 Published 2018-03-06 No fix listed CWE-79

TI-2017-07164 CVE-2017-9783 · GHSA-j7j5-9394-m949

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit…

LOW 29

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0108 Published 2018-03-06 No fix listed CWE-79

Vulnerabilities

Filters