PProjectSend

Products

Exploited and recent CVEs

• CVE-2024-11680 Critical 9.8 Exploited ProjectSend Unauthenticated Configuration Modification 91.8%
• CVE-2026-116136 Medium 5.9 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking 0.2%
• CVE-2026-112003 Medium 5.9 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete 0.4%
• CVE-2026-112002 Medium 6.8 ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password 0.3%
• CVE-2026-112001 High 7.2 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities 0.6%
• CVE-2026-53992 Medium 6.1 Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters 0.4%
• CVE-2021-47947 Medium 6.4 Projectsend r1295 Stored Cross-Site Scripting via files-edit.php 0.2%
• CVE-2023-53980 Critical 9.8 ProjectSend r1605 Remote Code Execution via File Extension Manipulation 0.9%
• CVE-2023-53930 High 7.5 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability 0.4%
• CVE-2023-53906 Medium 4.8 ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page 0.3%
• CVE-2023-53905 High 8.0 ProjectSend r1605 CSV Injection via User Account Export Functionality 0.5%
• CVE-2023-0607 High 7.2 Cross-site Scripting (XSS) - Stored in projectsend/projectsend 0.7%