Projectsend vulnerabilities

Products

• Projectsend 40

Newest

• projectsend ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking CVE-2026-116136 6.0 MediumOctober 25, 2026
• projectsend ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete CVE-2026-112003 6.0 MediumOctober 18, 2026
• projectsend ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password CVE-2026-112002 7.6 HighOctober 18, 2026
• projectsend ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities CVE-2026-112001 8.6 HighOctober 18, 2026
• projectsend Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters CVE-2026-53992 5.1 MediumAugust 5, 2026
• projectsend Projectsend r1295 Stored Cross-Site Scripting via files-edit.php CVE-2021-47947 5.1 MediumMay 10, 2026
• projectsend ProjectSend upload.php cross-site request forgery CVE-2026-5624 5.3 MediumApril 6, 2026
• projectsend projectsend Auth.php response discrepancy CVE-2026-4045 6.3 MediumMarch 12, 2026
• projectsend projectsend Delete import-orphans.php realpath path traversal CVE-2026-4044 5.1 MediumMarch 12, 2026
• projectsend projectsend AJAX Endpoints authorization CVE-2026-3977 5.3 MediumMarch 12, 2026
• projectsend ProjectSend r1605 Remote Code Execution via File Extension Manipulation CVE-2023-53980 8.7 HighDecember 22, 2025
• projectsend ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability CVE-2023-53930 7.1 HighDecember 17, 2025
• projectsend ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page CVE-2023-53906 5.1 MediumDecember 17, 2025
• projectsend ProjectSend r1605 CSV Injection via User Account Export Functionality CVE-2023-53905 6.2 MediumDecember 17, 2025
• projectsend projectsend File Editor/Custom Download Aliases cross site scripting CVE-2025-13232 5.1 MediumNovember 16, 2025
• projectsend ProjectSend Unauthenticated Configuration Modification CVE-2024-11680 In KEVPublic exploit EPSS 91.8% 9.8 CriticalNovember 26, 2024
• projectsend projectsend Password Reset Token functions.php generate_random_string random values CVE-2024-7659 6.3 MediumAugust 11, 2024
• projectsend projectsend process.php get_preview resource injection CVE-2024-7658 6.9 MediumAugust 11, 2024
• projectsend, projectsend projectsend/projectsend +1 more Cross-site Scripting (XSS) - Stored in projectsend/projectsend CVE-2023-0607 7.2 HighFebruary 1, 2023
• projectsend ProjectSend information disclosure CVE-2017-20101 3.5 LowJune 27, 2022
• projectsend Projectsend version r1295 is affected by sensitive information disclosure. Because of not... CVE-2021-40884 8.1 HighOctober 11, 2021
• projectsend Projectsend version r1295 is affected by a directory traversal vulnerability. A user with... CVE-2021-40886 6.5 MediumOctober 11, 2021
• projectsend Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking... CVE-2021-40887 9.8 CriticalOctober 11, 2021
• projectsend Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization... CVE-2021-40888 5.4 MediumOctober 11, 2021
• projectsend reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password... CVE-2020-28874 Public exploit 7.5 HighJanuary 21, 2021
• projectsend CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data... CVE-2018-7201 8.8 HighMay 22, 2019
• projectsend An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My... CVE-2018-7202 6.1 MediumMay 22, 2019
• projectsend Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to... CVE-2019-11533 6.1 MediumApril 26, 2019
• projectsend ProjectSend before r1070 writes user passwords to the server logs. CVE-2019-11492 7.5 HighApril 26, 2019
• projectsend An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../... CVE-2019-11378 8.8 HighApril 20, 2019
• projectsend ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log... CVE-2016-10734 9.8 CriticalOctober 28, 2018
• projectsend ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip... CVE-2016-10733 9.8 CriticalOctober 28, 2018
• projectsend ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php,... CVE-2016-10732 9.8 CriticalOctober 28, 2018
• projectsend ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request... CVE-2016-10731 9.8 CriticalOctober 28, 2018
• projectsend Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit... CVE-2017-9786 6.1 MediumMarch 6, 2018
• projectsend Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit... CVE-2017-9783 6.1 MediumMarch 6, 2018
• projectsend install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code... CVE-2017-9741 9.8 CriticalJune 18, 2017
• projectsend SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote... CVE-2015-2564 Public exploit 6.5 MediumMarch 20, 2015
• projectsend Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote... CVE-2014-9580 Public exploit 4.3 MediumJanuary 8, 2015
• projectsend Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100... CVE-2014-9567 Public exploit EPSS 43.3% 7.5 HighJanuary 7, 2015