Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

projectSend

Products: projectSend

40.6

Score

3

CVEs

1

Active

2

PoC

1

KEV

#61

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2023-53980	2025-12-22	8.7v4.0	POC	—	Low	Low	no	0.0	projectSend	ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
CVE-2023-53930	2025-12-17	7.1v4.0	POC	—	Low	Low	no	0.0	projectSend	ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
CVE-2024-11680	2024-11-26	9.8v3.1	ACTIVE		Low	None	YES	40.6	projectSend	ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3