CyberSec.Space Logo
Back to CVE Browser

CVE-2023-53906

MEDIUM
5.1
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-12-17
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.

Affected Platforms (CPE)

📦
Projectsend

Projectsend

= r1605

References & Advisories

🔗 https://www.exploit-db.com/exploits/51518
🔗 https://www.projectsend.org/
🔗 https://www.vulncheck.com/advisories/projectsend-stored-cross-site-scripting-via-custom-assets-page
🔗 https://www.exploit-db.com/exploits/51518

Related Vulnerabilities

CVE-2021-479475.1

Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scr...

CVE-2026-56242.1

A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performi...

CVE-2023-539808.7

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating f...

CVE-2023-539307.1

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download pri...