ProjectSend vulnerabilities
CVEs whose affected-version data names the ProjectSend package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-116136Medium· 5.9ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an inter…
CVE-2026-112001High· 7.2PoCProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_us…
CVE-2026-112003Medium· 5.9PoCProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans impor…
CVE-2026-112002Medium· 6.8ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a s…
CVE-2024-11680Critical· 9.8CISA KEVPoCProjectSend versions prior to r1720 are affected by an improper authentication vulnerability
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of …
CVE-2020-28874High· 7.5PoCreset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).