PR
Product
projectsend
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 8High 9Medium 17Low 3
Watch
Add projectsend to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-11680 In wildKEV | 9.8 | Nov 26 | ProjectSend Unauthenticated Configuration Modification Affected: before r1720 |
| CVE-2023-53980 | 9.8 | Dec 22 | ProjectSend r1605 Remote Code Execution via File Extension Manipulation Affected: r1605 |
| CVE-2021-40887 | 9.8 | Oct 11 | Projectsend version r1295 is affected by a directory traversal vulnerability Affected: r1295 |
| CVE-2016-10734 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php Affected: 582 |
| CVE-2016-10733 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string Affected: 582 |
| CVE-2016-10732 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or… Affected: 582 |
| CVE-2016-10731 | 9.8 | Oct 29 | ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with… Affected: 582 |
| CVE-2017-9741 | 9.8 | Jun 18 | install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the… Affected: r754 |
Showing 8