What’s Vulnerable › Products
ProjectSend vulnerabilities
40 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your ProjectSend version is affected
Exploited ProjectSend vulnerabilities
- CVE-2024-11680 — ProjectSend Improper Authentication Vulnerability
Latest ProjectSend vulnerabilities
- CVE-2026-116136 — ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking (CVSS 5.9)
- CVE-2026-112003 — ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete (CVSS 5.9)
- CVE-2026-112002 — ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password (CVSS 6.8)
- CVE-2026-112001 — ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities (CVSS 7.2)
- CVE-2026-53992 — Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters (CVSS 6.1)
- CVE-2021-47947 — Projectsend r1295 Stored Cross-Site Scripting via files-edit.php (CVSS 6.4)
- CVE-2026-5624 — ProjectSend upload.php cross-site request forgery (CVSS 4.3)
- CVE-2026-4045 — projectsend Auth.php response discrepancy (CVSS 3.7)
- CVE-2026-4044 — projectsend Delete import-orphans.php realpath path traversal (CVSS 3.8)
- CVE-2026-3977 — projectsend AJAX Endpoints authorization (CVSS 6.3)
- CVE-2023-53980 — ProjectSend r1605 Remote Code Execution via File Extension Manipulation (CVSS 9.8)
- CVE-2023-53930 — ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability (CVSS 7.5)
- CVE-2023-53906 — ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page (CVSS 4.8)
- CVE-2023-53905 — ProjectSend r1605 CSV Injection via User Account Export Functionality (CVSS 8.0)
- CVE-2025-13232 — projectsend File Editor/Custom Download Aliases cross site scripting (CVSS 3.5)
- CVE-2024-11680 — ProjectSend Improper Authentication Vulnerability (CVSS 9.8) — exploited
- CVE-2024-7659 — projectsend Password Reset Token functions.php generate_random_string random values (CVSS 7.5)
- CVE-2024-7658 — projectsend process.php get_preview resource injection (CVSS 5.3)
- CVE-2023-0607 — Cross-site Scripting (XSS) - Stored in projectsend/projectsend (CVSS 4.8)
- CVE-2017-20101 — ProjectSend information disclosure (CVSS 5.7)
- CVE-2021-40888 — (CVSS 5.4)
- CVE-2021-40887 — (CVSS 9.8)
- CVE-2021-40886 — (CVSS 6.5)
- CVE-2021-40884 — (CVSS 8.1)
- CVE-2020-28874 — (CVSS 7.5)