What’s Vulnerable › Vulnerabilities

CVE-2024-11680: ProjectSend Improper Authentication Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-12-03
• EPSS: 91.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-26 · updated 2026-07-14
• Weakness: CWE-306

Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Affected products

• ProjectSend: before r1720 — fixed in r1720

How to fix

Upgrade to a fixed version: ProjectSend r1720. Check the vendor advisory for mitigations.

References

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml
• https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
• https://vulncheck.com/advisories/projectsend-bypass
• https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680

Get alerted when CVE-2024-11680 or the next vulnerability affects your stack