{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T20:45:43.249Z",
  "tag": {
    "id": "projectsend",
    "label": "Projectsend",
    "isStack": false,
    "url": "https://pwn.watch/t/projectsend",
    "feed": "https://pwn.watch/t/projectsend/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "projectsend-cve-2024-11680",
      "title": "ProjectSend Improper Authentication",
      "url": "https://pwn.watch/i/projectsend-cve-2024-11680",
      "json": "https://pwn.watch/i/projectsend-cve-2024-11680.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "ProjectSend",
      "tags": [
        "php",
        "projectsend",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-11680"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-26",
      "closedAt": "2024-12-03",
      "updatedAt": "2024-12-03",
      "summary": "ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "projectsend-cve-2024-11680",
      "incidentTitle": "ProjectSend Improper Authentication",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "CISA added CVE-2024-11680 to the KEV catalog (federal deadline 2024-12-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/projectsend-cve-2024-11680"
    },
    {
      "incident": "projectsend-cve-2024-11680",
      "incidentTitle": "ProjectSend Improper Authentication",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-26",
      "title": "CVE-2024-11680 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-11680",
      "url": "https://pwn.watch/i/projectsend-cve-2024-11680"
    }
  ]
}