Skip to content
OpenAdvisories

Vendor

ProjectSend

12 known vulnerabilities.

Products

ProjectSend 11 projectsend/projectsend 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-112001

    ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

    ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can…

    ProjectSend ProjectSend
  • High 7.5
    CVE-2023-53930

    ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability

    ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' paramete…

    ProjectSend ProjectSend
  • High 8.0
    CVE-2023-53905

    ProjectSend r1605 CSV Injection via User Account Export Functionality

    ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export …

    ProjectSend ProjectSend
  • High 7.2
    CVE-2023-0607

    Cross-site Scripting (XSS) - Stored in projectsend/projectsend

    Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

    ProjectSend projectsend/projectsend