Vulnetix
Try Vulnetix Request Demo
CVE-2024-11680 PUBLISHED KEV CVSS 9.800000190734863 CRITICAL

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

EPSS 93.49% · 99.8th percentile

Risk Scores

CVSS v3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
93.49%
99.8th percentile

Affected Products

VendorProductVersions
ProjectSendProjectSend0
projectsendprojectsend0, 0
projectsendprojectsend0

Timeline

References

Open in Interactive Console →