U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:projectsend:projectsend:r754:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 7 matching records.
Displaying matches 1 through 7.
Vuln ID Summary CVSS Severity
CVE-2023-0607

Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

Published: January 31, 2023; 11:15:09 PM -0500 		V3.1: 4.8 MEDIUM
 V2.0:(not available)
CVE-2017-20101

A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.

Published: June 27, 2022; 10:15:07 AM -0400 		V3.1: 5.7 MEDIUM
 V2.0: 3.5 LOW
CVE-2020-28874

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

Published: January 26, 2021; 1:15:51 PM -0500 		V3.1: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2018-7202

An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.

Published: May 22, 2019; 2:29:00 PM -0400 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2017-9786

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php.

Published: March 06, 2018; 11:29:00 AM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2017-9783

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated.

Published: March 06, 2018; 11:29:00 AM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2017-9741

install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.

Published: June 18, 2017; 5:29:00 PM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH