CVE-2021-40886

Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value 2 for chunks parameter to bypass fileName sanitization...

Directory traversal

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder...

CVE-2021-40884

CVE-2021-40884 affects ProjectSend version r1295. The root cause is missing authorization checks for the ids parameter in files-edit.php and the id parameter in process.php, enabling a user with uploader role to download and edit all users’ files. The vulnerability is described across multiple so...

CVE-2021-40884

Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application...

CVE-2021-40884

Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application...

CVE-2021-40886

Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value 2 for chunks parameter to bypass fileName sanitization...

CVE-2021-40886

Projectsend (version r1295) is affected by a directory traversal vulnerability where a user with the Uploader role can set chunks=2 to bypass fileName sanitization. This root cause is a paths/discovery issue that could enable access to restricted files via crafted directory traversal input. The C...

CVE-2021-40886

Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value 2 for chunks parameter to bypass fileName sanitization...

CVE-2021-40887

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder...

CVE-2021-40887

CVE-2021-40887 affects Projectsend vR1295 and is a directory traversal vulnerability. The issue arises from lack of sanitization for the files[] input parameter, enabling an attacker to append ../ to paths and access arbitrary files within the /upload/files/ directory (or other files the web serv...

CVE-2021-40887

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder...

CVE-2021-40888

Projectsend version r1295 is affected by Cross Site Scripting XSS due to lack of sanitization when echo output data in returnFilesIds function. A low privilege user can call this function through process.php file and execute scripting code...

CVE-2021-40888

CVE-2021-40888 concerns Projectsend (r1295) with a stored/ reflected XSS caused by lack of sanitization in returnFilesIds() output in the processing path (process.php). A low-privilege user can trigger the function to execute arbitrary script code. The provided documents confirm the vulnerability...

CVE-2021-40888

Projectsend version r1295 is affected by Cross Site Scripting XSS due to lack of sanitization when echo output data in returnFilesIds function. A low privilege user can call this function through process.php file and execute scripting code...

PT-2021-23005

Name of the Vulnerable Software and Affected Versions Projectsend version r1295 Description The issue is caused by a lack of sanitization when echoing output data in the returnFilesIds function, allowing a low privilege user to execute scripting code through the process.php file. This is a Cross...

PT-2021-23003

Name of the Vulnerable Software and Affected Versions Projectsend version r1295 Description The issue allows a user with the Uploader role to bypass fileName sanitization by setting the value of the chunks parameter to 2, potentially leading to a directory traversal vulnerability. Recommendations...

PT-2021-23004

Name of the Vulnerable Software and Affected Versions Projectsend version r1295 Description The issue is related to a directory traversal vulnerability. Due to a lack of sanitization for the files parameter, an attacker can exploit this by adding ../ to move PHP files or any file on the system wi...

CVE-2021-40884: Missing Authorization

Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application...

CVE-2021-40887: Improper Limitation of a Pathname to a Restricted Directory

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder...

CVE-2021-40886: Improper Limitation of a Pathname to a Restricted Directory

Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value 2 for chunks parameter to bypass fileName sanitization...