GCVE - cpe:2.3:a:projectsend:projectsend:r1295:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:projectsend:projectsend:r1295:*:*:*:*:*:*:*

part: a version: r1295 update: *

Vendor	Projectsend (`756ba587-ea60-54ee-9d3e-01949cd8119b`)
Product	Projectsend (`25fe9e81-065f-5d3c-a2eb-36513b7100a6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/projectsend/projectsend`	purl2cpe	2026-06-01 10:17:15.076730

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-47947`	vulnerable	2026-06-08 05:38:07.956118	Projectsend r1295 Stored Cross-Site Scripting via files-edit.php MEDIUM (6.4) Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that execute in the browser when the file is viewed by other users, particularly affecting System Administrator users on the Dashboard page. Published: 2026-05-10T12:44:04.333Z Updated: 2026-05-24T01:37:10.910Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/50240 https://www.projectsend.org/ https://www.projectsend.org/download/387/ https://www.vulncheck.com/advisories/projectsend-r1295-stored-cross-site-scripting-via-files-edit-php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40888`	vulnerable	2026-06-08 05:35:19.288573	Details available Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code. Published: 2021-10-11T10:04:39.000Z Updated: 2024-08-04T02:51:07.768Z Open on db.gcve.eu Reference links https://github.com/projectsend/projectsend/issues/995 https://github.com/projectsend/projectsend/releases/tag/r1295	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40887`	vulnerable	2026-06-08 05:35:19.288262	Details available Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder. Published: 2021-10-11T10:12:06.000Z Updated: 2024-08-04T02:51:07.717Z Open on db.gcve.eu Reference links https://github.com/projectsend/projectsend/issues/994	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40886`	vulnerable	2026-06-08 05:35:19.287852	Details available Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization. Published: 2021-10-11T10:24:05.000Z Updated: 2024-08-04T02:51:07.780Z Open on db.gcve.eu Reference links https://github.com/projectsend/projectsend/issues/993	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40884`	vulnerable	2026-06-08 05:35:19.287452	Details available Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application. Published: 2021-10-11T10:46:59.000Z Updated: 2024-08-04T02:51:07.726Z Open on db.gcve.eu Reference links https://github.com/projectsend/projectsend/issues/992	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.