PR
Product
projectsend
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 8High 9Medium 17Low 3
Watch
Add projectsend to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-112002 | 6.8 | Oct 18 | ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password Affected: 2.5.0 before 2.7.0 |
| CVE-2021-40886 | 6.5 | Oct 11 | Projectsend version r1295 is affected by a directory traversal vulnerability Affected: r1295 |
| CVE-2021-47947 | 6.4 | May 10 | Projectsend r1295 Stored Cross-Site Scripting via files-edit.php Affected: r1295 |
| CVE-2026-3977 | 6.3 | Mar 12 | projectsend AJAX Endpoints authorization Affected: r1945 |
| CVE-2026-53992 | 6.1 | Aug 5 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters Affected: through b4ad95b |
| CVE-2018-7202 | 6.1 | May 22 | An issue was discovered in ProjectSend before r1053 Affected: before r1053 |
| CVE-2019-11533 | 6.1 | Apr 26 | Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML Affected: before 1070 |
| CVE-2017-9786 | 6.1 | Mar 6 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web… Affected: through r754 |
| CVE-2017-9783 | 6.1 | Mar 6 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web… Affected: through r754 |
| CVE-2026-116136 New | 5.9 | Oct 25 | ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking Affected: 2.0.0 through 2.7.1 |
| CVE-2026-112003 | 5.9 | Oct 18 | ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete Affected: 2.0.0 before 2.7.0 |
| CVE-2017-20101 | 5.7 | Jun 27 | A vulnerability, which was classified as problematic, was found in ProjectSend r754 Affected: r754 |
| CVE-2021-40888 | 5.4 | Oct 11 | Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function Affected: r1295 |
| CVE-2024-7658 | 5.3 | Aug 12 | A vulnerability, which was classified as problematic, has been found in projectsend up to r1605 Affected: before r1720 |
| CVE-2023-53906 | 4.8 | Dec 17 | ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page Affected: r1605 |
| CVE-2023-0607 | 4.8 | Feb 1 | Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606 Affected: before r1606 |
| CVE-2026-5624 | 4.3 | Apr 6 | ProjectSend upload.php cross-site request forgery Affected: r2002 |
Showing 17