= 2)

Cpe Name:cpe:2.3:a:projectsend:projectsend:r1295:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-40888	79	Exec Code XSS	2021-10-11	2021-10-18	3.5	None	Remote	Medium	???	None	Partial	None
Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.
2	CVE-2021-40887	22	Dir. Trav.	2021-10-11	2021-10-18	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.
3	CVE-2021-40886	22	Dir. Trav. Bypass	2021-10-11	2021-10-16	4.0	None	Remote	Low	???	None	Partial	None
Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.
4	CVE-2021-40884	863		2021-10-11	2021-10-16	5.5	None	Remote	Low	???	Partial	Partial	None
Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.

Total number of vulnerabilities : 4 Page : 1 (This Page)