ProjectSend vulnerabilities
We track 6 vulnerabilities in ProjectSend products. 6 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 18, 2026.
Latest ProjectSend vulnerabilities
- 7.2 High severity
ProjectSend: Incorrect Authorization
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can
- 9.8 Critical severity
projectSend: Unrestricted Upload of File with Dangerous Type
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute ar
- 7.5 High severity
projectSend: Authorization Bypass Through User-Controlled Key
ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter
- 8.0 High severity
projectSend: Improper Neutralization of Formula Elements in a CSV File
ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export a
- 9.8 Critical severity
ProjectSend Improper Authentication Exploited
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's confi
- 7.5 High severity
projectsend: Use of Insufficiently Random Values
A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficient