High severity · published Dec 17, 2025
CVE-2023-53930
ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
projectSend · projectSend
r1605 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-53930
Exploit
https://www.exploit-db.com/exploits/51400
Product
https://www.projectsend.org/
Exploit
https://www.vulncheck.com/advisories/projectsend-insecure-direct-object-reference-file-download-vulnerability
More from projectSend
9.8
CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
9.8
CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
9.8
CVE-2021-40887
Projectsend version r1295 is affected by a directory traversal vulnerability
9.8
CVE-2016-10734
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php
9.8
CVE-2016-10733
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string