Skip to content
Noroxi

ProjectSend records

29 published records for vendor projectsend.

Researcher profile

Entered KEV
1 · 3.4%
Weaponized
2 · 6.9%
Pre-auth RCE
2
With a fix record
0%
Median publish → KEV
7 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

29 records
  • CVE-2024-11680
    97Now

    ProjectSend Unauthenticated Configuration Modification

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    projectsend · projectsendNov 26, 2024

  • CVE-2014-9567
    43Plan

    Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to exe

    HighCVSS 7.5WeaponizedEPSS 43%

    projectsend · projectsendJan 7, 2015

  • CVE-2021-40887
    40Plan

    Projectsend version r1295 is affected by a directory traversal vulnerability.

    CriticalCVSS 9.8No exploitEPSS 2%

    projectsend · projectsendOct 11, 2021

  • CVE-2016-10733
    40Plan

    ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.

    CriticalCVSS 9.8No exploitEPSS 2%

    projectsend · projectsendOct 29, 2018

  • CVE-2016-10732
    40Plan

    ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or proc

    CriticalCVSS 9.8No exploitEPSS 2%

    projectsend · projectsendOct 29, 2018

  • CVE-2017-9741
    39Monitor

    install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to rep

    CriticalCVSS 9.8No exploitEPSS 2%

    projectsend · projectsendJun 18, 2017

  • CVE-2016-10734
    39Monitor

    ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

    CriticalCVSS 9.8No exploitEPSS 2%

    projectsend · projectsendOct 29, 2018

  • CVE-2016-10731
    39Monitor

    ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the requ

    CriticalCVSS 9.8No exploitEPSS 1%

    projectsend · projectsendOct 29, 2018

  • CVE-2019-11378
    36Monitor

    An issue was discovered in ProjectSend r1053.

    HighCVSS 8.8No exploitEPSS 4%

    projectsend · projectsendApr 20, 2019

  • CVE-2018-7201
    35Monitor

    CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.

    HighCVSS 8.8No exploitEPSS 1%

    projectsend · projectsendMay 22, 2019

  • CVE-2023-53980
    34Monitor

    ProjectSend r1605 Remote Code Execution via File Extension Manipulation

    HighCVSS 8.7No exploitEPSS 1%

    projectsend · projectsendDec 22, 2025

  • CVE-2021-40884
    32Monitor

    Projectsend version r1295 is affected by sensitive information disclosure.

    HighCVSS 8.1No exploitEPSS 1%

    projectsend · projectsendOct 11, 2021

  • CVE-2020-28874
    31Monitor

    reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic.

    HighCVSS 7.5Proof of conceptEPSS 2%

    projectsend · projectsendJan 26, 2021

  • CVE-2019-11492
    30Monitor

    ProjectSend before r1070 writes user passwords to the server logs.

    HighCVSS 7.5No exploitEPSS 1%

    projectsend · projectsendApr 26, 2019

  • CVE-2023-53930
    28Monitor

    ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    projectsend · projectsendDec 17, 2025

  • CVE-2015-2564
    27Monitor

    SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQ

    MediumCVSS 6.5Proof of conceptEPSS 3%

    projectsend · projectsendMar 20, 2015

  • CVE-2024-7658
    27Monitor

    projectsend process.php get_preview resource injection

    MediumCVSS 6.9No exploitEPSS 1%

    projectsend · projectsendAug 12, 2024

  • CVE-2021-40886
    26Monitor

    Projectsend version r1295 is affected by a directory traversal vulnerability.

    MediumCVSS 6.5No exploitEPSS 1%

    projectsend · projectsendOct 11, 2021

  • CVE-2024-7659
    25Monitor

    projectsend Password Reset Token functions.php generate_random_string random values

    MediumCVSS 6.3No exploitEPSS 1%

    projectsend · projectsendAug 12, 2024

  • CVE-2019-11533
    24Monitor

    Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.

    MediumCVSS 6.1No exploitEPSS 1%

    projectsend · projectsendApr 26, 2019

  • CVE-2017-9783
    24Monitor

    Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote

    MediumCVSS 6.1No exploitEPSS 1%

    projectsend · projectsendMar 6, 2018

  • CVE-2017-9786
    24Monitor

    Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote

    MediumCVSS 6.1No exploitEPSS 1%

    projectsend · projectsendMar 6, 2018

  • CVE-2018-7202
    24Monitor

    An issue was discovered in ProjectSend before r1053.

    MediumCVSS 6.1No exploitEPSS 1%

    projectsend · projectsendMay 22, 2019

  • CVE-2023-53905
    24Monitor

    ProjectSend r1605 CSV Injection via User Account Export Functionality

    MediumCVSS 6.2No exploitEPSS 1%

    projectsend · projectsendDec 17, 2025

  • CVE-2017-20101
    22Monitor

    ProjectSend information disclosure

    MediumCVSS 5.7No exploitEPSS 1%

    projectsend · projectsendJun 27, 2022