CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 22, 2025
- Updated
- Mar 5, 2026
- Reserved
- Dec 20, 2025
Description
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
projectSendProjectSend |
|
References
- ExploitDB-51238exploit
- Official Product Homepageproduct
- VulnCheck Advisory: ProjectSend r1605 Remote Code Execution via File Extension Manipulationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.