What’s Vulnerable › Vulnerabilities

CVE-2021-40888

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-11 · updated 2026-06-17
• Weakness: CWE-79

Description

Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.

Affected products

• ProjectSend: r1295

References

• https://github.com/projectsend/projectsend/issues/995
• https://github.com/projectsend/projectsend/releases/tag/r1295
• https://github.com/projectsend/projectsend/issues/995
• https://github.com/projectsend/projectsend/releases/tag/r1295

Get alerted when CVE-2021-40888 or the next vulnerability affects your stack