https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-53980.htmlhttps://patchthecve.com/cve/CVE-2023-53980.htmlWed, 17 Jun 2026 06:46:28 +0000CRITICAL 9.8: ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.https://patchthecve.com/cve/CVE-2023-53930.htmlhttps://patchthecve.com/cve/CVE-2023-53930.htmlWed, 17 Jun 2026 06:46:21 +0000HIGH 7.5: ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.https://patchthecve.com/cve/CVE-2023-53906.htmlhttps://patchthecve.com/cve/CVE-2023-53906.htmlWed, 17 Jun 2026 06:46:18 +0000MEDIUM 4.8: projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load thttps://patchthecve.com/cve/CVE-2023-53905.htmlhttps://patchthecve.com/cve/CVE-2023-53905.htmlWed, 17 Jun 2026 06:46:18 +0000HIGH 8.0: ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.https://patchthecve.com/cve/CVE-2024-11680.htmlhttps://patchthecve.com/cve/CVE-2024-11680.htmlTue, 14 Jul 2026 23:17:13 +0000CRITICAL 9.8: ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allowshttps://patchthecve.com/cve/CVE-2024-7659.htmlhttps://patchthecve.com/cve/CVE-2024-7659.htmlWed, 17 Jun 2026 08:20:38 +0000LOW 3.7: A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launhttps://patchthecve.com/cve/CVE-2024-7658.htmlhttps://patchthecve.com/cve/CVE-2024-7658.htmlWed, 17 Jun 2026 08:20:37 +0000MEDIUM 5.3: A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 i