projectsend projectsend r1295 vulnerabilities and exploits

(subscribe to this query)

5.5

CVSSv2

Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.

Projectsend Projectsend R1295

10

CVSSv2

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.

Projectsend Projectsend R1295

4

CVSSv2

Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.

Projectsend Projectsend R1295

3.5

CVSSv2

Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.

Projectsend Projectsend R1295

5

CVSSv2

reset-password.php in ProjectSend before r1295 allows remote malicious users to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

Projectsend Projectsend

1 Github repository

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook