Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to...
7.2CVSS
4.9AI Score
0.001EPSS
Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/...
9.8CVSS
9.5AI Score
0.004EPSS
Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value 2 for chunks parameter to bypass fileName...
6.5CVSS
6.5AI Score
0.001EPSS
Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting...
5.4CVSS
5.3AI Score
0.001EPSS
Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in...
8.1CVSS
7.7AI Score
0.001EPSS
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token...
7.5CVSS
7.6AI Score
0.004EPSS
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft...
8.8CVSS
7.8AI Score
0.002EPSS
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account...
6.1CVSS
6.4AI Score
0.001EPSS
7.5CVSS
7.3AI Score
0.002EPSS
Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or...
6.1CVSS
6.4AI Score
0.001EPSS
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary...
8.8CVSS
7.4AI Score
0.002EPSS
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query...
9.8CVSS
7.4AI Score
0.003EPSS
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to...
9.8CVSS
7.6AI Score
0.003EPSS
9.8CVSS
7.4AI Score
0.002EPSS
ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the....
9.8CVSS
9.8AI Score
0.001EPSS
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name...
6.1CVSS
6.2AI Score
0.001EPSS
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and...
6.1CVSS
6.3AI Score
0.001EPSS