ProjectSend

Every one of the 34 is a mark on the map. Named now: 1 to 26, most at risk first.

1. ProjectSend <= r1605 - Improper AuthorizationCVE-2024-11680ProjectSend · CVSS 9.8 · 92% likely

   CWE-306

2. Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a…CVE-2014-9567Projectsend · 43% likely

   CWE-94

3. An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potent…CVE-2019-11378Projectsend · 3.6% likely

   CWE-22

4. Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upl…CVE-2014-9580Projectsend · 3.2% likely

   CWE-79

5. SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to user…CVE-2015-2564Projectsend · 3.1% likely

   CWE-89

6. reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid toke…CVE-2020-28874Projectsend · 2.4% likely

   CWE-287

7. Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP…CVE-2021-40887Projectsend · 2.4% likely

   CWE-22

8. ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.CVE-2016-10733Projectsend · 2.1% likely

   CWE-22

9. ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_…CVE-2016-10732Projectsend · 1.9% likely

   CWE-287

10. install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configurati…CVE-2017-9741Projectsend · 1.6% likely

    CWE-20

11. ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.CVE-2016-10734Projectsend · 1.5% likely

    CWE-285

12. ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with t…CVE-2016-10731Projectsend · 1.4% likely

    CWE-89

13. Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.CVE-2021-40886Projectsend · 1.4% likely

    CWE-22

14. CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.CVE-2018-7201Projectsend · 1.3% likely

    CWE-1236

15. Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.CVE-2019-11533Projectsend · 1.2% likely

    CWE-79

16. ProjectSend information disclosureCVE-2017-20101Projectsend · CVSS 3.5 · 1.1% likely

    CWE-200

17. ProjectSend before r1070 writes user passwords to the server logs.CVE-2019-11492Projectsend · 1.1% likely

    CWE-532

18. Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web scri…CVE-2017-9783Projectsend · 1.1% likely

    CWE-79

19. Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web scri…CVE-2017-9786Projectsend · 1.0% likely

    CWE-79

20. Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php…CVE-2021-40884Projectsend · 1.0% likely

    CWE-862

21. ProjectSend r1605 Remote Code Execution via File Extension ManipulationCVE-2023-53980ProjectSend · CVSS 9.8 · 0.9% likely

    CWE-434

22. An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.CVE-2018-7202Projectsend · 0.8% likely

    CWE-79

23. projectsend process.php get_preview resource injectionCVE-2024-7658Projectsend · CVSS 5.3 · 0.8% likely

    CWE-99

24. projectsend Password Reset Token functions.php generate_random_string random valuesCVE-2024-7659Projectsend · CVSS 3.7 · 0.8% likely

    CWE-330

25. Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call t…CVE-2021-40888Projectsend · 0.6% likely

    CWE-79

26. ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesCVE-2026-112001ProjectSend · CVSS 7.2 · 0.6% likely

    CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.