CVE-2026-53992
MediumCVSS 6.1Summary
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
Risk Assessment
An authenticated user with edit_settings permissions could fall victim to an XSS attack, potentially leading to session hijacking, data theft, or unauthorized changes in the application.
Recommendation
Update ProjectSend to a patched version or apply proper input filtering.
Other vulnerabilities in ProjectSend
See all- CVE-2023-53980Critical
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
- CVE-2024-11680CriticalActively exploited
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- CVE-2021-47947Medium
Stored XSS in Projectsend r1295. Authenticated attackers can inject malicious script via the 'name' parameter in files-edit.php, which executes for administrators on the Dashboard.
- CVE-2026-5624Medium
Cross-Site Request Forgery (CSRF) vulnerability in ProjectSend r2002 in upload.php. The attack can be performed remotely. An exploit is publicly available.
- CVE-2020-28874High
A vulnerability in reset-password.php in ProjectSend before r1295 allows remote attackers to reset a user's password due to incorrect business logic. Errors are not properly considered, specifically an invalid token parameter.
Original NVD description (English source)
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.