PT-2026-25004 · Undefined · Undefined

0Xnayel + 1 · Published 2026-03-12 · Updated 2026-03-30 · CVE-2026-4045

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions projectsend versions prior to r1946

Description A flaw exists in projectsend up to revision r1945. This impacts an unknown function within the includes/Classes/Auth.php file. Manipulating the ldap email argument can cause an observable discrepancy in the response. The attack can be executed remotely and is associated with a high level of complexity. The exploit has been published. The vendor was contacted regarding this issue but did not respond.

Recommendations Update projectsend to version r1946 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-204

Related Identifiers

CVE-2026-4045

Affected Products

Undefined

References · 8

• 🔥 https://drive.google.com/file/d/1TNwWNTcra2ykx0yXpATPmsPgJxIxOrWb/view?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4045 · Security Note
• https://vuldb.com/?ctiid.350657 · Note
• https://t.me/CVEtracker/47275 · Telegram Post
• https://twitter.com/0xNayel/status/2038560041343541573 · Twitter Post
• https://twitter.com/CVEnew/status/2032230714020593900 · Twitter Post
• https://vuldb.com/?submit.769577 · Note
• https://vuldb.com/?id.350657 · Note