Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ProjectSend — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in ProjectSend, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for ProjectSend, a cloud-based file transfer service. It collects security advisories related to various weakness types, covering the time range from the product's launch to the present day. Here you can track the vendor's security advisories, understand the characteristics of specific weakness classes, and review the product's historical vulnerability record. The data is organized to support security professionals in assessing risk exposure and identifying recurring vulnerability patterns without requiring manual compilation from disparate sources.

Vendor: unspecified

CVE ID Title CVSS Severity Published
CVE-2026-53992 Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters CWE-79 6.1 Medium 2026-08-05
CVE-2021-47947 Projectsend r1295 Stored Cross-Site Scripting via files-edit.php CWE-79 6.4 Medium 2026-05-10
CVE-2026-5624 ProjectSend upload.php cross-site request forgery CWE-352 4.3 Medium 2026-04-06
CVE-2026-4045 projectsend Auth.php response discrepancy CWE-204 3.7 Low 2026-03-12
CVE-2026-4044 projectsend Delete import-orphans.php realpath path traversal CWE-22 3.8 Low 2026-03-12
CVE-2026-3977 projectsend AJAX Endpoints authorization CWE-862 6.3 Medium 2026-03-12
CVE-2023-53980 ProjectSend r1605 Remote Code Execution via File Extension Manipulation CWE-434 9.8 Critical 2025-12-22
CVE-2023-53930 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability CWE-639 7.5 High 2025-12-17
CVE-2023-53905 ProjectSend r1605 CSV Injection via User Account Export Functionality CWE-1236 8.0 High 2025-12-17
CVE-2023-53906 ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page CWE-79 4.8 Medium 2025-12-17
CVE-2025-13232 projectsend File Editor/Custom Download Aliases cross site scripting CWE-79 3.5 Low 2025-11-16
CVE-2024-11680 ProjectSend Unauthenticated Configuration Modification CWE-306 9.8 Critical 2024-11-26
CVE-2024-7659 projectsend Password Reset Token functions.php generate_random_string random values CWE-330 3.7 Low 2024-08-11
CVE-2024-7658 projectsend process.php get_preview resource injection CWE-99 5.3 Medium 2024-08-11
CVE-2017-20101 ProjectSend information disclosure CWE-200 3.5 Low 2022-06-27

All 15 known CVE vulnerabilities affecting ProjectSend with full Chinese analysis, references, and POCs where available.