Vulnerability · Published Aug 5, 2026 · Assigned by VulnCheck
CVE-2026-53992Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
Medium 6.1
In plain English
A medium-severity cross-site scripting in ProjectSend from ProjectSend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ProjectSend | ProjectSend | 0 – through b4ad95b |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N