What’s Vulnerable › Vulnerabilities

CVE-2023-53906: ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-17 · updated 2026-06-17
• Weakness: CWE-79

Description

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.

Affected products

• ProjectSend: r1605

References

• https://www.exploit-db.com/exploits/51518
• https://www.projectsend.org/
• https://www.vulncheck.com/advisories/projectsend-stored-cross-site-scripting-via-custom-assets-page
• https://www.exploit-db.com/exploits/51518

Get alerted when CVE-2023-53906 or the next vulnerability affects your stack