EUVD-2016-1729

Malware in sbrugna...

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

Directory traversal

ProjectSend formerly cFTP r582 allows directory traversal via file=../ in the process-zip-download.php query string...

Sql injection

ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...

CVE-2016-10731

CVE-2016-10731 affects ProjectSend (formerly cFTP) r582 and enables SQL injection via multiple PHP endpoints: manage-files.php (status, files), clients.php (selected_clients, status), process-zip-download.php (file), or home-log.php (action). Root cause: input parameters are used in SQL queries w...

CVE-2016-10733: Improper Limitation of a Pathname to a Restricted Directory

ProjectSend formerly cFTP r582 allows directory traversal via file=../ in the process-zip-download.php query string...

CVE-2016-10731: Improper Neutralization of Special Elements used in an SQL Command

ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...

PT-2018-4899

Name of the Vulnerable Software and Affected Versions ProjectSend formerly cFTP version r582 Description The issue allows directory traversal via the file parameter in the "/process-zip-download.php" endpoint. This can be exploited by including ../ in the file parameter of the query string...

PT-2018-4898

Name of the Vulnerable Software and Affected Versions ProjectSend formerly cFTP version r582 Description The issue allows for authentication bypass through direct requests to specific files or parameters. This can be achieved by accessing "users.php", "home.php", "edit-file.php?file id=1", or...

PT-2018-4897

Name of the Vulnerable Software and Affected Versions ProjectSend formerly cFTP version r582 Description The issue allows SQL injection via several API endpoints, including "manage-files.php" with the request parameters status and files, "clients.php" with the request parameters selected clients...