CVE-2016-10731

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-29 · updated 2026-06-17
Weakness: CWE-89

Description

ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.

Affected products

ProjectSend: 582

References

https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/
https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/

Get alerted when CVE-2016-10731 or the next vulnerability affects your stack