Vulnerabilities

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions.

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans.

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password.

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}.

ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_dat…

Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php.

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions.

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter.

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page.

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names.

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability.

A vulnerability, which was classified as problematic, was found in projectsend up to r1605.

A vulnerability, which was classified as problematic, has been found in projectsend up to r1605.

Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

A vulnerability, which was classified as problematic, was found in ProjectSend r754.

Projectsend version r1295 is affected by sensitive information disclosure.

Projectsend version r1295 is affected by a directory traversal vulnerability.

Projectsend version r1295 is affected by a directory traversal vulnerability.

Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function.

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic.

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.

An issue was discovered in ProjectSend before r1053.

Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.

ProjectSend before r1070 writes user passwords to the server logs.

An issue was discovered in ProjectSend r1053.