ReportizFlow
Filtered by vendor Projectsend
Subscriptions
Filtered by product Projectsend
Subscriptions
Total
33 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-3977 | 1 Projectsend | 1 Projectsend | 2026-03-13 | 6.3 Medium |
| A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch. | ||||
| CVE-2026-4044 | 1 Projectsend | 1 Projectsend | 2026-03-13 | 3.8 Low |
| A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Performing a manipulation of the argument files[] results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-4045 | 1 Projectsend | 1 Projectsend | 2026-03-13 | 3.7 Low |
| A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipulation of the argument ldap_email can lead to observable response discrepancy. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-53980 | 1 Projectsend | 1 Projectsend | 2026-03-05 | 9.8 Critical |
| ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server. | ||||
| CVE-2023-53930 | 1 Projectsend | 1 Projectsend | 2026-03-05 | 7.5 High |
| ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php. | ||||
| CVE-2023-53906 | 1 Projectsend | 1 Projectsend | 2026-03-05 | 4.8 Medium |
| projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection. | ||||
| CVE-2023-53905 | 1 Projectsend | 1 Projectsend | 2026-03-05 | 8 High |
| ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files. | ||||
| CVE-2025-13232 | 1 Projectsend | 1 Projectsend | 2026-02-24 | 3.5 Low |
| A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version r1945 is recommended to address this issue. Patch name: 334da1ea39cb12f6b6e98dd2f80bb033e0c7b845. It is advisable to upgrade the affected component. | ||||
| CVE-2024-11680 | 1 Projectsend | 1 Projectsend | 2025-11-22 | 9.8 Critical |
| ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. | ||||
| CVE-2017-9741 | 1 Projectsend | 1 Projectsend | 2025-04-20 | N/A |
| install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file. | ||||
| CVE-2017-20101 | 1 Projectsend | 1 Projectsend | 2025-04-15 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely. | ||||
| CVE-2014-9567 | 1 Projectsend | 1 Projectsend | 2025-04-12 | N/A |
| Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory. | ||||
| CVE-2015-2564 | 1 Projectsend | 1 Projectsend | 2025-04-12 | N/A |
| SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php. | ||||
| CVE-2014-9580 | 1 Projectsend | 1 Projectsend | 2025-04-12 | N/A |
| Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information. | ||||
| CVE-2023-0607 | 1 Projectsend | 1 Projectsend | 2025-03-27 | 4.8 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606. | ||||
| CVE-2024-7658 | 1 Projectsend | 1 Projectsend | 2025-01-14 | 5.3 Medium |
| A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component. | ||||
| CVE-2021-40888 | 1 Projectsend | 1 Projectsend | 2024-11-21 | 5.4 Medium |
| Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code. | ||||
| CVE-2021-40887 | 1 Projectsend | 1 Projectsend | 2024-11-21 | 9.8 Critical |
| Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder. | ||||
| CVE-2021-40886 | 1 Projectsend | 1 Projectsend | 2024-11-21 | 6.5 Medium |
| Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization. | ||||
| CVE-2021-40884 | 1 Projectsend | 1 Projectsend | 2024-11-21 | 8.1 High |
| Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application. | ||||