CVE-2026-5624

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5624", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-05T16:51:21.775Z", "datePublished": "2026-04-06T05:00:19.673Z", "dateUpdated": "2026-04-06T14:49:43.498Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T05:00:19.673Z"}, "title": "ProjectSend upload.php cross-site request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "Cross-Site Request Forgery"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "Missing Authorization"}]}], "affected": [{"vendor": "n/a", "product": "ProjectSend", "versions": [{"version": "r2002", "status": "affected"}, {"version": "r2029", "status": "unaffected"}], "cpes": ["cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-05T18:56:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "AquaNight (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB Vulnerability Moderation Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/355414", "name": "VDB-355414 | ProjectSend upload.php cross-site request forgery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355414/cti", "name": "VDB-355414 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785731", "name": "Submit #785731 | ProjectSend projectsend r2002 Cross-Site Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b", "tags": ["patch"]}, {"url": "https://github.com/projectsend/projectsend/releases/tag/r2029", "tags": ["patch"]}, {"url": "https://github.com/projectsend/projectsend/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T13:58:16.051108Z", "id": "CVE-2026-5624", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T14:49:43.498Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5624", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T13:58:16.051108Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T13:58:20.848Z"}}], "cna": {"tags": ["x_open-source"], "title": "ProjectSend upload.php cross-site request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "AquaNight (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB Vulnerability Moderation Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*"], "vendor": "n/a", "product": "ProjectSend", "versions": [{"status": "affected", "version": "r2002"}, {"status": "unaffected", "version": "r2029"}]}], "timeline": [{"lang": "en", "time": "2026-04-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-05T18:56:35.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355414", "name": "VDB-355414 | ProjectSend upload.php cross-site request forgery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355414/cti", "name": "VDB-355414 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785731", "name": "Submit #785731 | ProjectSend projectsend r2002 Cross-Site Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b", "tags": ["patch"]}, {"url": "https://github.com/projectsend/projectsend/releases/tag/r2029", "tags": ["patch"]}, {"url": "https://github.com/projectsend/projectsend/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "Cross-Site Request Forgery"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T05:00:19.673Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5624", "state": "PUBLISHED", "dateUpdated": "2026-04-06T14:49:43.498Z", "dateReserved": "2026-04-05T16:51:21.775Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-06T05:00:19.673Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*"], "product": "ProjectSend", "vendor": "n/a", "versions": [{"status": "affected", "version": "r2002"}, {"status": "unaffected", "version": "r2029"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en ProjectSend r2002. Esta vulnerabilidad afecta c\u00f3digo desconocido del archivo upload.php. Realizar una manipulaci\u00f3n resulta en falsificaci\u00f3n de petici\u00f3n en sitios cruzados. El ataque puede ser iniciado remotamente. El exploit ha sido liberado al p\u00fablico y puede ser usado para ataques. Actualizar a la versi\u00f3n r2029 es capaz de resolver este problema. El parche se llama 2c0d25824ab571b6c219ac1a188ad9350149661b. Deber\u00eda actualizar el componente afectado."}], "id": "CVE-2026-5624", "lastModified": "2026-07-24T09:10:00.153", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5624", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T13:58:16.051108Z", "version": "2.0.3"}}]}, "published": "2026-04-06T06:16:21.623", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/projectsend/projectsend/"}, {"source": "cna@vuldb.com", "url": "https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b"}, {"source": "cna@vuldb.com", "url": "https://github.com/projectsend/projectsend/releases/tag/r2029"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/785731"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355414"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355414/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "r2002"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "r2029"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ProjectSend", "source": "cna", "vendor": "n/a"}, "product": "projectsend", "vendor": "projectsend"}], "analysis": {"en": {"generated_at": "2026-04-06T08:20:31.960778+00:00", "value": {"mitigation_remediation": ["Upgrade ProjectSend to r2029", "Apply the patch commit 2c0d25824ab571b6c219ac1a188ad9350149661b if upgrading is not possible", "Verify the application reports the latest version"], "summary": {"action": "Patch", "impact": "Cross-site request forgery"}, "threat_synthesis": {"affected_systems": "Any installation of ProjectSend running version r2002 or earlier is affected, since the flaw resides in upload.php. The vendor recommends upgrading to release r2029, which incorporates the fix identified by commit 2c0d25824ab571b6c219ac1a188ad9350149661b. No other products or vendors are listed.", "description_and_impact": "ProjectSend r2002 contains a flaw in upload.php that permits cross\u2011site request forgery. An attacker could send a crafted HTTP request that triggers an action normally protected by the user\u2019s session, allowing unauthorized file uploads or other privileged actions. The CVE description refers to this as a CSRF vulnerability (CWE\u2011352) and notes that the exploit has been publicly released, indicating that remote attackers can target the vulnerable component.", "risk_and_exploitability": "The CVSS score of 5.3 reflects moderate severity, though EPSS data is not available and the vulnerability is not listed in the KEV catalog. Based on the description, it is inferred that the attack can be initiated remotely, and the existence of a public exploit suggests that attackers can employ the flaw to perform unauthorized actions over the network. Consequently, the risk is moderate and the vulnerability can be exploited without specialized prerequisites."}}}}, "created": "2026-04-06T20:15:06.282755+00:00", "updated": "2026-04-06T21:47:23.346004+00:00", "vendors": ["projectsend", "projectsend$PRODUCT$projectsend"]}