CyberSec.Space Logo
CVEブラウザに戻る

CVE-2023-53930

HIGH
7.1
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-12-17
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.

Affected Platforms (CPE)

📦
Projectsend

Projectsend

= r1605

References & Advisories

🔗 https://www.exploit-db.com/exploits/51400
🔗 https://www.projectsend.org/
🔗 https://www.vulncheck.com/advisories/projectsend-insecure-direct-object-reference-file-download-vulnerability
🔗 https://www.exploit-db.com/exploits/51400

関連する脆弱性情報

CVE-2021-479475.1

Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scr...

CVE-2026-56242.1

A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performi...

CVE-2023-539808.7

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating f...

CVE-2023-539065.1

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject maliciou...