CVE-2020-28874

State: Published
Severity: Not scored
Published: Jan 21, 2021
Updated: Jul 9, 2026
Reserved: Nov 16, 2020

Description

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/projectsend/projectsend/commits/master
https://github.com/varandinawer/CVE-2020-28874
https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e
https://github.com/projectsend/projectsend/releases/tag/r1295

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.