CyberRota Analysis
AI-GeneratedProjectSend r2029 is vulnerable to a reflected cross-site scripting (XSS) flaw in the thumbnails-regenerate.php file, allowing attackers to inject arbitrary HTML and JavaScript via unsanitized GET parameters. This vulnerability can be exploited by authenticated users with edit_settings permissions, potentially leading to session cookie theft and unauthorized actions such as user and file management. Organizations using this version of ProjectSend should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.