Vulnerabilidades em ProjectSend
12 resultadosAnálise Vexday
O ProjectSend apresenta um perfil de risco moderado com 2 vulnerabilidades catalogadas, sendo 1 explorada ativamente em campo e 1 crítica (CVSS 9+). A fraqueza dominante é a falta de autenticação adequada (CWE-306), expondo funcionalidades sensíveis. Não há registros de novas vulnerabilidades nos últimos 90 dias, sugerindo que o risco atual não está em evolução recente.
CVE-2024-11680CRITICALProjectSend Unauthenticated Configuration ModificationEPSS 91.8%KEVCVE-2023-53980HIGHProjectSend r1605 Remote Code Execution via File Extension ManipulationEPSS 0.9%CVE-2023-0607HIGHCross-site Scripting (XSS) - Stored in projectsend/projectsendEPSS 0.7%CVE-2026-112001HIGHProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesEPSS 0.6%CVE-2023-53905MEDIUMProjectSend r1605 CSV Injection via User Account Export FunctionalityEPSS 0.5%CVE-2026-112003MEDIUMProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteEPSS 0.4%CVE-2026-53992MEDIUMReflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date ParametersEPSS 0.4%CVE-2023-53930HIGHProjectSend r1605 Insecure Direct Object Reference File Download VulnerabilityEPSS 0.4%CVE-2023-53906MEDIUMProjectSend r1605 Stored Cross-Site Scripting via Custom Assets PageEPSS 0.3%CVE-2026-112002HIGHProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/passwordEPSS 0.3%CVE-2021-47947MEDIUMProjectsend r1295 Stored Cross-Site Scripting via files-edit.phpEPSS 0.2%CVE-2026-116136MEDIUMProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version LinkingEPSS 0.2%