CVE-2024-11680
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CISA Known Exploited Vulnerability
Vendor / Product
ProjectSend — ProjectSend
Date Added
2024-12-03
Remediation Due
2024-12-24
https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11680
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| projectsend | projectsend | < r1720 |
References & Advisories (6)
US Government Resource
Third Party Advisory
Patch
Mitigation
Technical Description
Third Party Advisory
Exploit
Broken Link
Third Party Advisory