ProjectSend vulnerabilities
6 known CVE vulnerabilities in ProjectSend, translated and rated.
- CVE-2026-53992Medium
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
- CVE-2023-53980Critical
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
- CVE-2024-11680CriticalActively exploited
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- CVE-2021-47947Medium
Stored XSS in Projectsend r1295. Authenticated attackers can inject malicious script via the 'name' parameter in files-edit.php, which executes for administrators on the Dashboard.
- CVE-2026-5624Medium
Cross-Site Request Forgery (CSRF) vulnerability in ProjectSend r2002 in upload.php. The attack can be performed remotely. An exploit is publicly available.
- CVE-2020-28874High
A vulnerability in reset-password.php in ProjectSend before r1295 allows remote attackers to reset a user's password due to incorrect business logic. Errors are not properly considered, specifically an invalid token parameter.