Projectsend vulnerabilities
12 published CVEs name Projectsend among the affected products; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 12
- Last 12 months
- 10
- Critical
- 1
- Known exploited
- 1
Critical 1High 5Medium 6Low 0Not scored 0
CVEs per yearBy the year they were published
- 20231
- 20241
- 20254
- 20266
Known exploitedNewest addition to KEV first
- CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
ProjectSend · ProjectSend
ExploitedCritical9.8
Newest CVEs
- CVE-2026-116136
ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
projectsend · ProjectSend
Medium6.0 - CVE-2026-112003
ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
ProjectSend · ProjectSend
Medium6.0 - CVE-2026-112002
ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
ProjectSend · ProjectSend
High7.6 - CVE-2026-112001
ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
ProjectSend · ProjectSend
High8.6 - CVE-2026-53992
Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
ProjectSend · ProjectSend
Medium5.1 - CVE-2021-47947
Projectsend r1295 Stored Cross-Site Scripting via files-edit.php
Projectsend · Projectsend
Medium5.1 - CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
ProjectSend · projectSend
High8.7 - CVE-2023-53930
ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability
projectSend · projectSend
High7.1 - CVE-2023-53906
ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page
projectSend · projectSend
Medium5.1 - CVE-2023-53905
ProjectSend r1605 CSV Injection via User Account Export Functionality
projectSend · projectSend
Medium6.2