Access Control

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.CVE-2016-10734Projectsend · 1.5% likely

   CWE-285

2. Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php…CVE-2021-40884Projectsend · 1.0% likely

   CWE-862

3. ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesCVE-2026-112001ProjectSend · CVSS 7.2 · 0.6% likely

   CWE-863

4. ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version LinkingCVE-2026-116136projectsend · CVSS 5.9 · 0.2% likely

   CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.