https://pwn.watch/t/projectsend Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 03 Dec 2024 00:00:00 GMT https://pwn.watch/i/projectsend-cve-2024-11680 https://pwn.watch/i/projectsend-cve-2024-11680 Tue, 03 Dec 2024 00:00:00 GMT critical <p>ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-03: CISA added CVE-2024-11680 to the KEV catalog (federal deadline 2024-12-24) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-11-26: CVE-2024-11680 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-11680">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-11680</p>