CSV Injection exists in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
projectsend projectsend