PR
Product
projectsend
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 8High 9Medium 17Low 3
Watch
Add projectsend to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-11680 In wildKEV | 9.8 | Nov 26 | ProjectSend Unauthenticated Configuration Modification Affected: before r1720 |
| CVE-2023-53980 | 9.8 | Dec 22 | ProjectSend r1605 Remote Code Execution via File Extension Manipulation Affected: r1605 |
| CVE-2021-40887 | 9.8 | Oct 11 | Projectsend version r1295 is affected by a directory traversal vulnerability Affected: r1295 |
| CVE-2016-10734 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php Affected: 582 |
| CVE-2016-10733 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string Affected: 582 |
| CVE-2016-10732 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or… Affected: 582 |
| CVE-2016-10731 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with… Affected: 582 |
| CVE-2017-9741 | 9.8 | Jun 18 | install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the… Affected: r754 |
| CVE-2018-7201 | 8.8 | May 22 | CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel Affected: before 1053 |
| CVE-2019-11378 | 8.8 | Apr 20 | An issue was discovered in ProjectSend r1053 Affected: r1053 |
| CVE-2021-40884 | 8.1 | Oct 11 | Projectsend version r1295 is affected by sensitive information disclosure Affected: r1295 |
| CVE-2023-53905 | 8.0 | Dec 17 | ProjectSend r1605 CSV Injection via User Account Export Functionality Affected: r1605 |
| CVE-2023-53930 | 7.5 | Dec 17 | ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability Affected: r1605 |
| CVE-2024-7659 | 7.5 | Aug 12 | A vulnerability, which was classified as problematic, was found in projectsend up to r1605 Affected: before r1720 |
| CVE-2020-28874 | 7.5 | Jan 26 | reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic Affected: before r1295 |
| CVE-2019-11492 | 7.5 | Apr 26 | ProjectSend before r1070 writes user passwords to the server logs Affected: before 1070 |
| CVE-2026-112001 | 7.2 | Oct 18 | ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities Affected: 2.0.0 before 2.7.0 |
| CVE-2026-112002 | 6.8 | Oct 18 | ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password Affected: 2.5.0 before 2.7.0 |
| CVE-2021-40886 | 6.5 | Oct 11 | Projectsend version r1295 is affected by a directory traversal vulnerability Affected: r1295 |
| CVE-2021-47947 | 6.4 | May 10 | Projectsend r1295 Stored Cross-Site Scripting via files-edit.php Affected: r1295 |
| CVE-2026-3977 | 6.3 | Mar 12 | projectsend AJAX Endpoints authorization Affected: r1945 |
| CVE-2026-53992 | 6.1 | Aug 5 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters Affected: through b4ad95b |
| CVE-2018-7202 | 6.1 | May 22 | An issue was discovered in ProjectSend before r1053 Affected: before r1053 |
| CVE-2019-11533 | 6.1 | Apr 26 | Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML Affected: before 1070 |
| CVE-2017-9786 | 6.1 | Mar 6 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web… Affected: through r754 |
| CVE-2017-9783 | 6.1 | Mar 6 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web… Affected: through r754 |
| CVE-2026-116136 New | 5.9 | Oct 25 | ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking Affected: 2.0.0 through 2.7.1 |
| CVE-2026-112003 | 5.9 | Oct 18 | ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete Affected: 2.0.0 before 2.7.0 |
| CVE-2017-20101 | 5.7 | Jun 27 | A vulnerability, which was classified as problematic, was found in ProjectSend r754 Affected: r754 |
| CVE-2021-40888 | 5.4 | Oct 11 | Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function Affected: r1295 |
| CVE-2024-7658 | 5.3 | Aug 12 | A vulnerability, which was classified as problematic, has been found in projectsend up to r1605 Affected: before r1720 |
| CVE-2023-53906 | 4.8 | Dec 17 | ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page Affected: r1605 |
| CVE-2023-0607 | 4.8 | Feb 1 | Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606 Affected: before r1606 |
| CVE-2026-5624 | 4.3 | Apr 6 | ProjectSend upload.php cross-site request forgery Affected: r2002 |
| CVE-2026-4044 | 3.8 | Mar 12 | projectsend Delete import-orphans.php realpath path traversal Affected: r1945 |
| CVE-2026-4045 | 3.7 | Mar 12 | projectsend Auth.php response discrepancy Affected: r1945 |
| CVE-2025-13232 | 3.5 | Nov 16 | projectsend File Editor/Custom Download Aliases cross site scripting Affected: r1720 |
| CVE-2015-2564 | – | Mar 20 | SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to… Affected: 561 |
| CVE-2014-9580 | – | Jan 8 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file… Affected: 561 |
| CVE-2014-9567 | – | Jan 7 | Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a… Affected: 100; 102; 105; 110; 155; 156; +9 more |
Showing 40