Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: ProjectSend 2.7.0 Clear all filters
TI-2026-76155 CVE-2026-112003 · GHSA-f5fh-phpc-hrv4

ProjectSend Path Validation Bypass via Orphan File Import and Delete

Priority MEDIUM 60

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00432 Published 2026-10-18 Fixed in 2.7.0 CWE-180
TI-2026-76154 CVE-2026-112002 · GHSA-xr56-2553-vh5p

Unverified password change in ProjectSend lets attackers take over accounts

Priority LOW 35

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.0029 Published 2026-10-18 Fixed in 2.7.0 CWE-620
TI-2026-76153 CVE-2026-112001 · GHSA-7c3c-3r99-phc3

ProjectSend users API flaw lets token holders take over accounts

Priority HIGH 72

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00617 Published 2026-10-18 Fixed in 2.7.0 CWE-863