GCVE - cpe:2.3:a:projectsend:projectsend:r1605:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:projectsend:projectsend:r1605:*:*:*:*:*:*:*

part: a version: r1605 update: *

Vendor	Projectsend (`756ba587-ea60-54ee-9d3e-01949cd8119b`)
Product	Projectsend (`25fe9e81-065f-5d3c-a2eb-36513b7100a6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/projectsend/projectsend`	purl2cpe	2026-06-01 10:17:15.076737

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-53980`	vulnerable	2026-06-08 06:19:40.244079	ProjectSend r1605 Remote Code Execution via File Extension Manipulation CRITICAL (9.8) ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server. Published: 2025-12-22T21:35:36.344Z Updated: 2026-03-05T12:03:24.363Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51238 https://www.projectsend.org/ https://www.vulncheck.com/advisories/projectsend-remote-code-execution-via-file-extension-manipulation	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-53930`	vulnerable	2026-06-08 06:19:40.039537	ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability HIGH (7.5) ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php. Published: 2025-12-17T22:44:57.996Z Updated: 2026-04-07T14:07:51.107Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51400 https://www.projectsend.org/ https://www.vulncheck.com/advisories/projectsend-insecure-direct-object-reference-file-download-vulnerability	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-53906`	vulnerable	2026-06-08 06:19:39.985362	ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page MEDIUM (4.8) projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection. Published: 2025-12-17T22:44:45.325Z Updated: 2026-04-07T14:07:28.276Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51518 https://www.projectsend.org/ https://www.vulncheck.com/advisories/projectsend-stored-cross-site-scripting-via-custom-assets-page	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-53905`	vulnerable	2026-06-08 06:19:39.984853	ProjectSend r1605 CSV Injection via User Account Export Functionality HIGH (8) ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc\|a!z\| in the name field to trigger code execution when administrators export action logs as CSV files. Published: 2025-12-17T22:44:44.505Z Updated: 2026-04-07T14:07:27.179Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51517 https://www.projectsend.org/ https://www.vulncheck.com/advisories/projectsend-csv-injection-via-user-account-export-functionality	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.