Sign in Free assessment

send project records

2 published records for vendor send project.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

17
24

Bar: total · dark part: CISA KEV.

Recurring classes

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

2 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
22Monitor	CVE-2015-8859No exploit	The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.send project · send Pre-auth	Medium5.3	—	4.7%	Jan 23, 2017
18Monitor	CVE-2024-43799No exploit	send vulnerable to template injection that can lead to XSSsend project · send · CWE-79 Pre-auth XSS SSTI	Medium4.7	—	0.5%	Sep 10, 2024

CVE-2015-8859
22Monitor
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
MediumCVSS 5.3No exploitEPSS 5%
- Pre-auth
send project · sendJan 23, 2017
CVE-2024-43799
18Monitor
send vulnerable to template injection that can lead to XSS
MediumCVSS 4.7No exploitEPSS 1%
send project · sendSep 10, 2024