CVE-2024-11680criticalunder attackCWE-306

CVE-2024-11680: critical vulnerability in ProjectSend

ProjectSend Unauthenticated Configuration Modification

Published · Updated

Follow this CVE+ Monitor ProjectSend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 92%
from disclosure to weapon8 days
Published on NVDNov 26
1st PoC+8d
metasploitJul 19
CISA KEV+7d
Action required by CISAfederal deadline: 2024-12-24

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

ProjectSend before version r1720 allows anyone on the internet to change the application's settings without logging in. Attackers can create fake accounts, upload malicious files, and inject harmful code into the website.

Technical detail

CWE-306 missing authentication vulnerability in options.php allows unauthenticated HTTP requests to modify ProjectSend configuration. Pre-conditions: unpatched version prior to r1720 accessible via web. Impact includes unauthorized account creation, arbitrary file upload (webshells), and persistent JavaScript injection.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ProjectSend · ProjectSend
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ProjectSend

In the same product, most dangerous first.

CVE-2026-112001HIGHProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesEPSS 0.6%CVE-2026-112003MEDIUMProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteEPSS 0.4%CVE-2026-53992MEDIUMReflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date ParametersEPSS 0.4%CVE-2026-112002HIGHProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/passwordEPSS 0.3%