PR
Product
projectsend
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 8High 9Medium 17Low 3
Watch
Add projectsend to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-7201 | 8.8 | May 22 | CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel Affected: before 1053 |
| CVE-2019-11378 | 8.8 | Apr 20 | An issue was discovered in ProjectSend r1053 Affected: r1053 |
| CVE-2021-40884 | 8.1 | Oct 11 | Projectsend version r1295 is affected by sensitive information disclosure Affected: r1295 |
| CVE-2023-53905 | 8.0 | Dec 17 | ProjectSend r1605 CSV Injection via User Account Export Functionality Affected: r1605 |
| CVE-2023-53930 | 7.5 | Dec 17 | ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability Affected: r1605 |
| CVE-2024-7659 | 7.5 | Aug 12 | A vulnerability, which was classified as problematic, was found in projectsend up to r1605 Affected: before r1720 |
| CVE-2020-28874 | 7.5 | Jan 26 | reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic Affected: before r1295 |
| CVE-2019-11492 | 7.5 | Apr 26 | ProjectSend before r1070 writes user passwords to the server logs Affected: before 1070 |
| CVE-2026-112001 | 7.2 | Oct 18 | ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities Affected: 2.0.0 before 2.7.0 |
Showing 9