---
id: CVE-2024-11680
title: >-
  ProjectSend versions prior to r1720 are affected by an improper authentication
  vulnerability
summary: >-
  ProjectSend versions prior to r1720 are affected by an improper authentication
  vulnerability. Remote, unauthenticated attackers can exploit this flaw by
  sending crafted HTTP requests to options.php, enabling unauthorized
  modification of …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
  - CWE-306
vendor: projectsend
product: projectsend
affected:
  - projectsend < r1720
patched:
  - projectsend r1720
published: '2024-11-26'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-11680'
references:
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
    label: disclosure@vulncheck.com
  - url: 'https://vulncheck.com/advisories/projectsend-bypass'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.91697
epssPercentile: 0.99813
kev: true
kevDateAdded: '2024-12-03'
kevDueDate: '2024-12-24'
kevRansomware: false
exploited: true
ingestedAt: '2026-07-14T23:40:05.122Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/D3N14LD15K/CVE-2024-11680_PoC_Exploit'
    - 'https://github.com/qucklecrabik/CVE-2024-11680'
  metasploit:
    - exploit/linux/http/projectsend_unauth_rce
  nuclei:
    - CVE-2024-11680
  checkedAt: '2026-09-25T08:20:42.729Z'
exploitAvailable: true
---

## Overview

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

## Affected

- `projectsend < r1720`

## Remediation

Upgrade past the affected range:

- `projectsend r1720`