GCVE - cpe:2.3:a:projectsend:projectsend:582:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:projectsend:projectsend:582:*:*:*:*:*:*:*

part: a version: 582 update: *

Vendor	Projectsend (`756ba587-ea60-54ee-9d3e-01949cd8119b`)
Product	Projectsend (`25fe9e81-065f-5d3c-a2eb-36513b7100a6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/projectsend/projectsend`	purl2cpe	2026-06-01 10:17:15.076720

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-10734`	vulnerable	2026-06-08 05:07:25.652620	Details available ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php. Published: 2018-10-28T03:00:00.000Z Updated: 2024-08-06T03:30:20.155Z Open on db.gcve.eu Reference links https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10733`	vulnerable	2026-06-08 05:07:25.652360	Details available ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. Published: 2018-10-28T03:00:00.000Z Updated: 2024-08-06T03:30:20.152Z Open on db.gcve.eu Reference links https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10732`	vulnerable	2026-06-08 05:07:25.652068	Details available ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php. Published: 2018-10-28T03:00:00.000Z Updated: 2024-08-06T03:30:20.339Z Open on db.gcve.eu Reference links https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10731`	vulnerable	2026-06-08 05:07:25.651679	Details available ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action. Published: 2018-10-28T03:00:00.000Z Updated: 2024-08-06T03:30:20.167Z Open on db.gcve.eu Reference links https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.