CVE-2026-112002
MediumCVSS 6.8Summary
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Risk Assessment
A stolen session cookie can be used to persistently take over an account, including enrolling a second factor, leading to full compromise of the user's account.
Recommendation
Update ProjectSend to version 2.7.0 or later and, if compromise is suspected, invalidate active sessions and force users to re-authenticate.
Other vulnerabilities in ProjectSend
See all- CVE-2026-112003Medium
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
- CVE-2026-112001High
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
- CVE-2023-53980Critical
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
- CVE-2024-11680CriticalActively exploited
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- CVE-2026-53992Medium
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
- CVE-2021-47947Medium
Stored XSS in Projectsend r1295. Authenticated attackers can inject malicious script via the 'name' parameter in files-edit.php, which executes for administrators on the Dashboard.
- CVE-2026-5624Medium
Cross-Site Request Forgery (CSRF) vulnerability in ProjectSend r2002 in upload.php. The attack can be performed remotely. An exploit is publicly available.
- CVE-2020-28874High
A vulnerability in reset-password.php in ProjectSend before r1295 allows remote attackers to reset a user's password due to incorrect business logic. Errors are not properly considered, specifically an invalid token parameter.
Original NVD description (English source)
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS