CVE-2024-11680_PoC_Exploit

CVE-2024-11680 PoC Exploit This repository contains a Proof of Concept PoC exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and older versions. The exploit targets an improper authentication flaw due Privilege Misconfiguration issues. Features Exploits improper auth to...

ProjectSend <= r1605 - Improper Authorization

An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to...

CVE-2020-28874

This repository contains the description of the vulnerability found CVE-2020-28874 in ProjectSend r1270 release. Thank you to my colleagues from Entelgy Innotec Security for pushing me to improve! CVE-2020-28874: Privilege Escalation Description The vulnerability is in the reset password componen...

CVE-2026-112003

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112001

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112002

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create...

EUVD-2026-103456

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003

ProjectSend versions 2.0.0 before 2.7.0 are vulnerable to a path validation flaw within the OrphanFileScanner::isOrphan() function. This flaw allows staff members with import_orphans permissions to bypass the delete_others_files restriction by submitting ./ path aliases to the orphans import or d...

CVE-2026-112002

ProjectSend versions 2.5.0 before 2.7.0 are vulnerable to an unverified password change in the PasswordController::update() function. This flaw allows accounts provisioned via social login to set local passwords without providing the current password. An attacker possessing a stolen session cooki...

CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112002 ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create...

CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112002 ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create...

EUVD-2026-103455

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create...

EUVD-2026-103454

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001

ProjectSend versions 2.0.0 before 2.7.0 are vulnerable to an incorrect authorization flaw (CWE-863) within the Users API. Specifically, API token holders with restricted permissions (limited to manage_users and edit_users) can exploit the PATCH /api/v1/users/{user} endpoint to modify the credenti...

CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112003: Incorrect Behavior Order: Validate Before Canonicalize

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112002: Unverified Password Change

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create...