{"id":"CVE-2020-28874","title":"reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic","summary":"reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-287","CWE-404"],"vendor":"projectsend","product":"projectsend","affected":["projectsend < r1295"],"patched":["projectsend r1295"],"published":"2021-01-26","updated":"2026-07-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-28874","references":[{"url":"https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e","label":"cve@mitre.org"},{"url":"https://github.com/projectsend/projectsend/commits/master","label":"cve@mitre.org"},{"url":"https://github.com/projectsend/projectsend/releases/tag/r1295","label":"cve@mitre.org"},{"url":"https://github.com/varandinawer/CVE-2020-28874","label":"cve@mitre.org"},{"url":"http://projectsend.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/projectsend/projectsend/commits/master","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/projectsend/projectsend/releases/tag/r1295","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/varandinawer/CVE-2020-28874","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.02351,"epssPercentile":0.82786,"ingestedAt":"2026-07-05T00:59:25.801Z","exploits":{"github":1,"githubRepos":["https://github.com/varandinawer/CVE-2020-28874"],"checkedAt":"2026-09-21T15:24:07.220Z"},"exploitAvailable":true,"slug":"CVE-2020-28874","body":"## Overview\n\nreset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).\n\n## Affected\n\n- `projectsend < r1295`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `projectsend r1295`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[{"seq":4492,"id":"CVE-2020-28874","ts":1788887184350,"field":"exploit_available","old":"false","new":"true"},{"seq":3375,"id":"CVE-2020-28874","ts":1788886303134,"field":"exploit_available","old":"true","new":"false"},{"seq":2230,"id":"CVE-2020-28874","ts":1788882972764,"field":"exploit_available","old":"false","new":"true"},{"seq":1259,"id":"CVE-2020-28874","ts":1788882384380,"field":"exploit_available","old":"true","new":"false"},{"seq":373,"id":"CVE-2020-28874","ts":1788881819758,"field":"exploit_available","old":"false","new":"true"}]}