https://pwn.watch/i/projectsend-cve-2024-11680 ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03. en Tue, 03 Dec 2024 00:00:00 GMT https://pwn.watch/i/projectsend-cve-2024-11680 https://pwn.watch/i/projectsend-cve-2024-11680#2024-12-03-e7d2bdc3 Tue, 03 Dec 2024 00:00:00 GMT critical <p><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Source</a></p> https://pwn.watch/i/projectsend-cve-2024-11680 https://pwn.watch/i/projectsend-cve-2024-11680#2024-11-26-b0f212fd Tue, 26 Nov 2024 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2024-11680">Source</a></p>