CVE-2026-53992mediumCWE-79

CVE-2026-53992: medium-severity vulnerability in ProjectSend

Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters

Published · Updated

Follow this CVE+ Monitor ProjectSend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.4%
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
ProjectSend · ProjectSend
Related CVEs — ProjectSend

In the same product, most dangerous first.

CVE-2024-11680CRITICALProjectSend Unauthenticated Configuration ModificationEPSS 91.8%KEVCVE-2026-112001HIGHProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesEPSS 0.6%CVE-2026-112003MEDIUMProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteEPSS 0.4%CVE-2026-112002HIGHProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/passwordEPSS 0.3%