{"items":[{"id":"CVE-2026-116136","published":"2026-10-25T11:51:01.317Z","updated":"2026-10-29T19:51:01.337Z","title":"ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking","severity":"MEDIUM","score":6,"vendor":"projectsend","product":"ProjectSend","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-112003","published":"2026-10-18T11:38:27.804Z","updated":"2026-10-19T18:41:57.810Z","title":"ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete","severity":"MEDIUM","score":6,"vendor":"ProjectSend","product":"ProjectSend","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-112002","published":"2026-10-18T11:38:27.111Z","updated":"2026-10-19T16:38:48.998Z","title":"ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password","severity":"HIGH","score":7.6,"vendor":"ProjectSend","product":"ProjectSend","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-112001","published":"2026-10-18T11:38:26.451Z","updated":"2026-10-19T15:55:45.461Z","title":"ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities","severity":"HIGH","score":8.6,"vendor":"ProjectSend","product":"ProjectSend","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2026-53992","published":"2026-08-05T14:54:41.657Z","updated":"2026-08-14T16:50:17.873Z","title":"Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters","severity":"MEDIUM","score":5.1,"vendor":"ProjectSend","product":"ProjectSend","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2021-47947","published":"2026-05-10T12:44:04.333Z","updated":"2026-05-24T01:37:10.910Z","title":"Projectsend r1295 Stored Cross-Site Scripting via files-edit.php","severity":"MEDIUM","score":5.1,"vendor":"Projectsend","product":"Projectsend","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2023-53980","published":"2025-12-22T21:35:36.344Z","updated":"2026-03-05T12:03:24.363Z","title":"ProjectSend r1605 Remote Code Execution via File Extension Manipulation","severity":"HIGH","score":8.7,"vendor":"ProjectSend","product":"projectSend","kev":false,"epss":0.00946,"kevAdded":null},{"id":"CVE-2023-53930","published":"2025-12-17T22:44:57.996Z","updated":"2026-04-07T14:07:51.107Z","title":"ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability","severity":"HIGH","score":7.1,"vendor":"projectSend","product":"projectSend","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2023-53906","published":"2025-12-17T22:44:45.325Z","updated":"2026-04-07T14:07:28.276Z","title":"ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page","severity":"MEDIUM","score":5.1,"vendor":"projectSend","product":"projectSend","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2023-53905","published":"2025-12-17T22:44:44.505Z","updated":"2026-04-07T14:07:27.179Z","title":"ProjectSend r1605 CSV Injection via User Account Export Functionality","severity":"MEDIUM","score":6.2,"vendor":"projectSend","product":"projectSend","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2024-11680","published":"2024-11-26T09:55:23.588Z","updated":"2026-07-14T22:54:33.035Z","title":"ProjectSend Unauthenticated Configuration Modification","severity":"CRITICAL","score":9.8,"vendor":"ProjectSend","product":"ProjectSend","kev":true,"epss":0.91849,"kevAdded":"2024-12-03"},{"id":"CVE-2023-0607","published":"2023-02-01T00:00:00.000Z","updated":"2025-03-27T14:36:50.513Z","title":"Cross-site Scripting (XSS) - Stored in projectsend/projectsend","severity":"HIGH","score":7.2,"vendor":"projectsend","product":"projectsend/projectsend","kev":false,"epss":0.00682,"kevAdded":null}]}