Login Request a demo
PR
Vendor
projectsend
1 product with CVEs on record
40
CVEs
1
On KEV
4
New 30D
Products
PR
projectsend
projectsend
9.8
40 CVEs1 on KEV4 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-116136
New
PR
ProjectSend
projectsend
5.9
0%
Oct 25ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
CVE-2026-112003
PR
ProjectSend
ProjectSend
5.9
0%
Oct 18ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
CVE-2026-112002
PR
ProjectSend
ProjectSend
6.8
0%
Oct 18ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
CVE-2026-112001
PR
ProjectSend
ProjectSend
7.2
1%
Oct 18ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
CVE-2026-53992
PR
ProjectSend
ProjectSend
6.1
0%
Aug 5Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
CVE-2021-47947
PR
Projectsend
Projectsend
6.4
0%
May 10Projectsend r1295 Stored Cross-Site Scripting via files-edit.php
CVE-2026-5624
PR
ProjectSend
Projectsend
4.3
0%
Apr 6ProjectSend upload.php cross-site request forgery
CVE-2026-4045
PR
projectsend
Projectsend
3.7
0%
Mar 12projectsend Auth.php response discrepancy
CVE-2026-4044
PR
projectsend
Projectsend
3.8
0%
Mar 12projectsend Delete import-orphans.php realpath path traversal
CVE-2026-3977
PR
projectsend
Projectsend
6.3
0%
Mar 12projectsend AJAX Endpoints authorization
CVE-2023-53980
PR
projectSend
ProjectSend
9.8
1%
Dec 22ProjectSend r1605 Remote Code Execution via File Extension Manipulation
CVE-2023-53930
PR
projectSend
projectSend
7.5
0%
Dec 17ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability
CVE-2023-53906
PR
projectSend
projectSend
4.8
0%
Dec 17ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page
CVE-2023-53905
PR
projectSend
projectSend
8.0
1%
Dec 17ProjectSend r1605 CSV Injection via User Account Export Functionality
CVE-2025-13232
PR
projectsend
Projectsend
3.5
0%
Nov 16projectsend File Editor/Custom Download Aliases cross site scripting
CVE-2024-11680
In wildKEV
PR
ProjectSend
ProjectSend
9.8
92%
Nov 26ProjectSend Unauthenticated Configuration Modification
CVE-2024-7659
PR
Projectsend
Projectsend
7.5
1%
Aug 12A vulnerability, which was classified as problematic, was found in projectsend up to r1605
CVE-2024-7658
PR
Projectsend
Projectsend
5.3
1%
Aug 12A vulnerability, which was classified as problematic, has been found in projectsend up to r1605
CVE-2023-0607
PR
Projectsend
Projectsend
4.8
1%
Feb 1Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606
CVE-2017-20101
PR
Projectsend
Projectsend
5.7
1%
Jun 27A vulnerability, which was classified as problematic, was found in ProjectSend r754
CVE-2021-40888
PR
Projectsend
Projectsend
5.4
1%
Oct 11Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function
CVE-2021-40887
PR
Projectsend
Projectsend
9.8
2%
Oct 11Projectsend version r1295 is affected by a directory traversal vulnerability
CVE-2021-40886
PR
Projectsend
Projectsend
6.5
1%
Oct 11Projectsend version r1295 is affected by a directory traversal vulnerability
CVE-2021-40884
PR
Projectsend
Projectsend
8.1
1%
Oct 11Projectsend version r1295 is affected by sensitive information disclosure
CVE-2020-28874
PR
Projectsend
Projectsend
7.5
2%
Jan 26reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic
CVE-2018-7201
PR
Projectsend
Projectsend
8.8
1%
May 22CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel
CVE-2018-7202
PR
Projectsend
Projectsend
6.1
1%
May 22An issue was discovered in ProjectSend before r1053
CVE-2019-11533
PR
Projectsend
Projectsend
6.1
1%
Apr 26Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML
CVE-2019-11492
PR
Projectsend
Projectsend
7.5
1%
Apr 26ProjectSend before r1070 writes user passwords to the server logs
CVE-2019-11378
PR
Projectsend
Projectsend
8.8
4%
Apr 20An issue was discovered in ProjectSend r1053
CVE-2016-10734
PR
Projectsend
Projectsend
9.8
2%
Oct 29ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php
CVE-2016-10733
PR
Projectsend
Projectsend
9.8
2%
Oct 29ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string
CVE-2016-10732
PR
Projectsend
Projectsend
9.8
2%
Oct 29ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or…
CVE-2016-10731
PR
Projectsend
Projectsend
9.8
1%
Oct 29ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with…
CVE-2017-9786
PR
Projectsend
Projectsend
6.1
1%
Mar 6Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web…
CVE-2017-9783
PR
Projectsend
Projectsend
6.1
1%
Mar 6Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web…
CVE-2017-9741
PR
Projectsend
Projectsend
9.8
2%
Jun 18install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the…
CVE-2015-2564
PR
Projectsend
Projectsend
–
3%
Mar 20SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to…
CVE-2014-9580
PR
Projectsend
Projectsend
–
3%
Jan 8Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file…
CVE-2014-9567
PR
Projectsend
Projectsend
–
43%
Jan 7Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a…