PT-2026-39521 · Unknown · Projectsend

Abdullah Kala · Published 2026-05-10 · Updated 2026-05-10 · CVE-2021-47947

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Projectsend version r1295

Description An authenticated attacker can inject malicious scripts by submitting crafted input through the name parameter in the 'files-edit.php' endpoint. These JavaScript payloads execute in the browser of other users, specifically targeting System Administrator users on the Dashboard page, when the file is viewed. This is a stored cross-site scripting issue, where a script is permanently stored on the server and served to other users.

Recommendations As a temporary workaround, restrict access to the 'files-edit.php' endpoint or avoid using the name parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47947

Affected Products

Projectsend

References · 6

• 🔥 https://exploit-db.com/exploits/50240 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47947 · Security Note
• https://twitter.com/CVEnew/status/2053537419086254482 · Twitter Post
• https://vulncheck.com/advisories/projectsend-r1295-stored-cross-site-scripting-via-files-edit-php · Note
• https://projectsend.org · Note
• https://projectsend.org/download/387 · Note