Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40 results
Oct 25, 2026ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorCVE-2026-116136 · Other software · projectsend · reported by VulnCheckMedium 6
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat trackeCVE-2026-112003 · Other software · ProjectSend · reported by VulnCheckMedium 6
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accCVE-2026-112002 · Other software · ProjectSend · reported by VulnCheckHigh 7.6
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentialCVE-2026-112001 · Other software · ProjectSend · reported by VulnCheckHigh 8.6
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML andCVE-2026-53992 · Other software · ProjectSend · reported by VulnCheckMedium 5.1
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2026Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted inpCVE-2021-47947 · Other software · Projectsend · reported by VulnCheckMedium 5.1
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that execute in the browser when the file is viewed by other users, particularly affecting System Administrator users on the Dashboard page.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comprojectsend.org
Apr 6, 2026A security flaw has been discovered in ProjectSend r2002.CVE-2026-5624 · Other software · reported by VulDBLow 2.1
A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A flaw has been found in projectsend up to r1945.CVE-2026-4045 · Other software · reported by VulDBLow 2.9
A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipulation of the argument ldap_email can lead to observable response discrepancy. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 12, 2026A vulnerability was detected in projectsend up to r1945.CVE-2026-4044 · Other software · reported by VulDBLow 2
A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Performing a manipulation of the argument files[] results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 12, 2026A security vulnerability has been detected in projectsend up to r1945.CVE-2026-3977 · Other software · reported by VulDBMedium 5.3
A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2025ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions.CVE-2023-53980 · Other software · ProjectSend · reported by VulnCheckHigh 8.7
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
- Product
- projectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comprojectsend.org
Dec 17, 2025ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating theCVE-2023-53930 · Other software · projectSend · reported by VulnCheckHigh 7.1
ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
- Product
- projectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comprojectsend.org
Dec 17, 2025projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custoCVE-2023-53906 · Other software · projectSend · reported by VulnCheckMedium 5.1
projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.
- Product
- projectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comprojectsend.org
Dec 17, 2025ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names.CVE-2023-53905 · Other software · projectSend · reported by VulnCheckMedium 6.2
ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.
- Product
- projectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comprojectsend.org
Nov 15, 2025A flaw has been found in projectsend up to r1720.CVE-2025-13232 · Other software · reported by VulDBLow 2
A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version r1945 is recommended to address this issue. Patch name: 334da1ea39cb12f6b6e98dd2f80bb033e0c7b845. It is advisable to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024ProjectSend Improper Authentication VulnerabilityCVE-2024-11680 · Other software · ProjectSend · reported by VulnCheckExploitedCritical 9.8
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- Product
- ProjectSend
- On CISA’s list since
- Dec 3, 2024 (federal fix deadline Dec 24, 2024)
- What to do
- Attackers are using this now. Install ProjectSend’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Aug 12, 2024A vulnerability, which was classified as problematic, was found in projectsend up to r1605.CVE-2024-7659 · Other software · Projectsend · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024A vulnerability, which was classified as problematic, has been found in projectsend up to r1605.CVE-2024-7658 · Other software · projectsend · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.
- Product
- projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.CVE-2023-0607 · Other software · projectsend · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.
- Product
- projectsend/projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A vulnerability, which was classified as problematic, was found in ProjectSend r754.CVE-2017-20101 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function.CVE-2021-40888 · Other software · Projectsend · reported by MITREMedium 5.4
Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021Projectsend version r1295 is affected by a directory traversal vulnerability.CVE-2021-40887 · Other software · Projectsend · reported by MITRECritical 9.8
Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021Projectsend version r1295 is affected by a directory traversal vulnerability.CVE-2021-40886 · Other software · Projectsend · reported by MITREMedium 6.5
Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021Projectsend version r1295 is affected by sensitive information disclosure.CVE-2021-40884 · Other software · Projectsend · reported by MITREHigh 8.1
Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic.CVE-2020-28874 · Other software · Projectsend · reported by MITREHigh 7.5
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2019CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.CVE-2018-7201 · Other software · Projectsend · reported by MITREHigh 8.8
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprojectsend.orgprojectsend.org
May 22, 2019An issue was discovered in ProjectSend before r1053.CVE-2018-7202 · Other software · Projectsend · reported by MITREMedium 6.1
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprojectsend.orgprojectsend.org
Apr 26, 2019Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.CVE-2019-11533 · Other software · Projectsend · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comprojectsend.org
Apr 26, 2019ProjectSend before r1070 writes user passwords to the server logs.CVE-2019-11492 · Other software · Projectsend · reported by MITREHigh 7.5
ProjectSend before r1070 writes user passwords to the server logs.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprojectsend.orgprojectsend.org
Apr 20, 2019An issue was discovered in ProjectSend r1053.CVE-2019-11378 · Other software · Projectsend · reported by MITREHigh 8.8
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 29, 2018ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.CVE-2016-10734 · Other software · Projectsend · reported by MITRECritical 9.8
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.CVE-2016-10733 · Other software · Projectsend · reported by MITRECritical 9.8
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.phpCVE-2016-10732 · Other software · Projectsend · reported by MITRECritical 9.8
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files,CVE-2016-10731 · Other software · Projectsend · reported by MITRECritical 9.8
ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2018Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to injectCVE-2017-9786 · Other software · Projectsend · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2018Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to injectCVE-2017-9783 · Other software · Projectsend · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2017install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIXCVE-2017-9741 · Other software · Projectsend · reported by MITRECritical 9.8
install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2015SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the iCVE-2015-2564 · Other software · Projectsend · reported by MITREMedium 6.5
SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Jan 8, 2015Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description CVE-2014-9580 · Other software · Projectsend · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 7, 2015Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP cCVE-2014-9567 · Other software · Projectsend · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.