ProjectSend has 5 CVEs on record between 2021 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.2 (high), with 1 rated critical. 20% have been exploited in the wild — well above the 1% corpus average, so ProjectSend flaws are worth patching on sight.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 20% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —(1)
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2024-11680Critical· 9.8ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability97CVE-2020-28874High· 7.5reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic54CVE-2026-112001High· 7.2ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities40CVE-2026-112002Medium· 6.8ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password37CVE-2026-112003Medium· 5.9ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete32
ProjectSend vulnerabilities
CVEs affecting ProjectSend, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-112001High· 7.2ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_us…
CVE-2026-112003Medium· 5.9ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans impor…
CVE-2026-112002Medium· 6.8ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a s…
CVE-2024-11680Critical· 9.8CISA KEVPoCProjectSend versions prior to r1720 are affected by an improper authentication vulnerability
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of …
CVE-2020-28874High· 7.5PoCreset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).