CVE-2026-53992 | Medium | 6.1 | 2026-08-05 | ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML an… |
CVE-2021-47947 | Medium | 6.4 | 2026-05-10 | Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted in… |
CVE-2023-53980 | Critical | 9.8 | 2025-12-22 | ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can… |
CVE-2023-53930 | High | 7.5 | 2025-12-17 | ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating th… |
CVE-2023-53906 | Medium | 4.8 | 2025-12-17 | projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the cust… |
CVE-2023-53905 | High | 8.0 | 2025-12-17 | ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can cr… |
CVE-2024-11680 | Critical | 9.8 | 2024-11-26 | ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sendin… |
CVE-2024-7659 | Low | 3.7 | 2024-08-12 | A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file include… |
CVE-2024-7658 | Medium | 5.3 | 2024-08-12 | A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file proces… |
CVE-2023-0607 | Medium | 4.8 | 2023-02-01 | Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606. |
CVE-2017-20101 | Low | 3.5 | 2022-06-27 | A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The… |
CVE-2021-40888 | Medium | 5.4 | 2021-10-11 | Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privi… |
CVE-2021-40887 | Critical | 9.8 | 2021-10-11 | Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add… |
CVE-2021-40886 | Medium | 6.5 | 2021-10-11 | Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fil… |
CVE-2021-40884 | High | 8.1 | 2021-10-11 | Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id para… |
CVE-2020-28874 | High | 7.5 | 2021-01-26 | reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly conside… |
CVE-2018-7201 | High | 8.8 | 2019-05-22 | CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. |
CVE-2018-7202 | Medium | 6.1 | 2019-05-22 | An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page. |
CVE-2019-11533 | Medium | 6.1 | 2019-04-26 | Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML. |
CVE-2019-11492 | High | 7.5 | 2019-04-26 | ProjectSend before r1070 writes user passwords to the server logs. |
CVE-2019-11378 | High | 8.8 | 2019-04-20 | An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitra… |
CVE-2016-10734 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php. |
CVE-2016-10733 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. |
CVE-2016-10732 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.ph… |
CVE-2016-10731 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files… |
CVE-2017-9786 | Medium | 6.1 | 2018-03-06 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to injec… |
CVE-2017-9783 | Medium | 6.1 | 2018-03-06 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to injec… |
CVE-2017-9741 | Critical | 9.8 | 2017-06-18 | install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFI… |
CVE-2015-2564 | | | 2015-03-20 | SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the… |
CVE-2014-9580 | | | 2015-01-08 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description… |
CVE-2014-9567 | | | 2015-01-07 | Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP… |