CVE-2024-11680

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score79.8830%

EPSS Percentile89.42th

Published2024-11-26

Last Modified2026-07-14

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Affected Platforms (CPE)

📦

Projectsend

< r1720

References & Advisories

🔗 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml

🔗 https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744

🔗 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb

🔗 https://vulncheck.com/advisories/projectsend-bypass

🔗 https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680

Vulnerability Description

Affected Platforms (CPE)

Projectsend

References & Advisories

相关漏洞威胁