CVE-2020-28874

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...

CVE-2020-28874

The CVE-2020-28874 issue affects ProjectSend’s reset-password.php before r1295, where incorrect business logic allows password reset without a valid token. Root cause: user_data is derived from an uncleaned username (GET parameter) and then reused in POST flow, enabling an attacker to trick the s...

CVE-2020-28874

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...

Exploit for Improper Authentication in Projectsend

This repository contains the description of the vulnerability fo...

PT-2021-11590

Name of the Vulnerable Software and Affected Versions: ProjectSend versions prior to r1295 Description: The issue arises from incorrect business logic in the reset-password.php file, allowing remote attackers to reset a password. Specifically, errors are not properly considered, such as an invali...

CVE-2020-28875

An issue was found in projectsend before r1295. There is an infinite loading during errors. It was fixed in commit 3f6fc1a...

ProjectSend cross-site scripting vulnerability (CNVD-2019-36883)

ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A cross-site scripting vulnerability exists in the 'Name' field of the My Account page in versions prior to ProjectSend r1053. The vulnerability stems from the WEB application's lack of proper...

Input validation

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...

CVE-2018-7201

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...

CVE-2018-7201

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...

CVE-2018-7201

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...

CVE-2018-7201

CVE-2018-7201 corresponds to a CSV Injection vulnerability in ProjectSend prior to version r1053. The issue arises when exporting/loading data for use in Microsoft Excel, enabling injection via CSV fields. Affected product: ProjectSend (before r1053). Root cause details are described only as a CS...

CVE-2018-7201

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...

CVE-2018-7202

An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...

CVE-2018-7202

An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...

CVE-2018-7202

An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...

CVE-2018-7202

CVE-2018-7202 affects ProjectSend prior to r1053, where an XSS flaw exists in the Name field on the My Account page. Root cause: insufficient input validation/escaping in that field, enabling injection of client-side scripts. Impact is cross-site scripting affecting users handling their My Accoun...

CVE-2018-7202

An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...

ProjectSend CVS Injection Vulnerability

rojectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A CVS injection vulnerability exists in versions prior to ProjectSend r1053 that affects victims who import data into Microsoft Excel...

PT-2019-11091

Name of the Vulnerable Software and Affected Versions: ProjectSend versions prior to r1053 Description: A CSV Injection issue was discovered, affecting users who import data into Microsoft Excel. Recommendations: For versions prior to r1053, update to version r1053 or later to resolve the issue...