450 matches found
CVE-2020-28874
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...
Default credentials
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...
CVE-2020-28874: Improper Authentication
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...
ProjectSend Security Vulnerability
ProjectSend formerly cFTP is a suite of self-hosted applications based on PHP and MySQL. ProjectSend before r1295 suffers from a security vulnerability that incorrectly resets passwords due to faulty business logic...
CVE-2020-28874
The CVE-2020-28874 issue affects ProjectSend’s reset-password.php before r1295, where incorrect business logic allows password reset without a valid token. Root cause: user_data is derived from an uncleaned username (GET parameter) and then reused in POST flow, enabling an attacker to trick the s...
CVE-2020-28874
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...
CVE-2020-28874
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...
Exploit for Improper Authentication in Projectsend
This repository contains the description of the vulnerability fo...
PT-2021-11590
Name of the Vulnerable Software and Affected Versions: ProjectSend versions prior to r1295 Description: The issue arises from incorrect business logic in the reset-password.php file, allowing remote attackers to reset a password. Specifically, errors are not properly considered, such as an invali...
CVE-2020-28875
An issue was found in projectsend before r1295. There is an infinite loading during errors. It was fixed in commit 3f6fc1a...
ProjectSend cross-site scripting vulnerability (CNVD-2019-36883)
ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A cross-site scripting vulnerability exists in the 'Name' field of the My Account page in versions prior to ProjectSend r1053. The vulnerability stems from the WEB application's lack of proper...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
Input validation
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CVE-2018-7201 corresponds to a CSV Injection vulnerability in ProjectSend prior to version r1053. The issue arises when exporting/loading data for use in Microsoft Excel, enabling injection via CSV fields. Affected product: ProjectSend (before r1053). Root cause details are described only as a CS...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7202
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...