Advisories · Technology
ProjectSend.
Every CVE that names ProjectSend among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.0 Medium
ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
- ProjectSend
- Broken access control
- CVSS 6.0 Medium
ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
- ProjectSend
- CWE-180
- CVSS 7.6 High
ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
- ProjectSend
- CWE-620
- CVSS 8.6 High
ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
- ProjectSend
- Broken access control
- CVSS 5.1 Medium
Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
- ProjectSend
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Projectsend r1295 Stored Cross-Site Scripting via files-edit.php
- Projectsend
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
ProjectSend upload.php cross-site request forgery
- ProjectSend
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 6.3 Medium
projectsend Auth.php response discrepancy
- projectsend
- Information disclosure
- CWE-204
- CVSS 5.1 Medium
projectsend Delete import-orphans.php realpath path traversal
- projectsend
- Path traversal
- CVSS 5.3 Medium
projectsend AJAX Endpoints authorization
- projectsend
- Broken access control
- CVSS 8.7 High
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
- projectSend
- Unrestricted file upload
- CVSS 7.1 High
ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability
- projectSend
- Broken access control
- CVSS 5.1 Medium
ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page
- projectSend
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
ProjectSend r1605 CSV Injection via User Account Export Functionality
- projectSend
- Other injection
- CVSS 5.1 Medium
projectsend File Editor/Custom Download Aliases cross site scripting
- projectsend
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
ProjectSend Unauthenticated Configuration Modification
- ProjectSend
- Authentication bypass
- CVSS 6.3 Medium
projectsend Password Reset Token functions.php generate_random_string random values
- projectsend
- Weak cryptography or TLS
- CVSS 6.9 Medium
projectsend process.php get_preview resource injection
- projectsend
- CWE-99
- CVSS 3.5 Low
ProjectSend information disclosure
- ProjectSend
- Information disclosure