← Vulnerability feed

Vulnerability record · CVE-2023-53930 · published 17 December 2025

CVE-2023-53930: Projectsend insecure direct object reference vulnerability

Projectsend · Projectsend

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.

7.1 CVSS 4.0 High EPSS 0.38% · top 70.3% CWE-639 · Insecure direct object reference
7.1CVSS 4.0 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 3 tagged exploit
17 Jun 2026Last modified by NVD

Description

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.exploit-db.com/exploits/51400 ExploitThird Party Advisory
https://www.projectsend.org/ Product
https://www.vulncheck.com/advisories/projectsend-insecure-direct-object-reference-file-download-vulnerability ExploitThird Party Advisory
https://www.exploit-db.com/exploits/51400 ExploitThird Party Advisory

Track CVE-2023-53930 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-11680ProjectSend improper authentication allows unauthenticated config changesProjectSend versions prior to r1720 expose options.php without authentication, letting remote attackers modify application configuration. Because con…KEVEPSS 92%analysed9.8CVE-2021-40887Projectsend path traversal vulnerabilityProjectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacke…EPSS 2.4%9.8CVE-2016-10732Projectsend improper authentication vulnerabilityProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-d…EPSS 1.9%9.8CVE-2016-10733Projectsend path traversal vulnerabilityProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.EPSS 2.1%9.8CVE-2016-10734Projectsend improper authorization vulnerabilityProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.EPSS 1.5%9.8CVE-2016-10731Projectsend sql injection vulnerabilityProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request param…EPSS 1.4%9.8CVE-2017-9741Projectsend improper input validation vulnerabilityinstall/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TA…EPSS 1.6%8.8CVE-2018-7201Projectsend csv injection vulnerabilityCSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2023-53930), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.