Skip to content
Fencer Vulns
critical 9.8

CVE-2024-11680 kev in the critical feed json

ProjectSend Unauthenticated Configuration Modification

published 2024-11-26 23 mo ago modified 2026-07-14 3 mo ago also EUVD-2024-34152

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2024-12-03
epss
91.8%
EPSS 91.8% chance of exploitation in 30 days, percentile 99.8%
public exploits
1
Metasploit, plus a Nuclei check

Summary

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  • ProjectSend ProjectSend r1720

Timeline

  1. First public exploit (Metasploit exploit/linux/http/projectsend_unauth_rce)
  2. Published
  3. Added to CISA KEV
  4. CISA SSVC: exploitation active
  5. CISA patch deadline

Known exploited

Added
23 mo ago
Patch by
2024-12-24 (22 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product
ProjectSend, ProjectSend
CISA name
ProjectSend Improper Authentication Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
23 mo ago

Exploit prediction

91.85% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/http/projectsend_unauth_rce ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution metasploit exploit, excellent rank, 2024-07-19
  • Nuclei template ProjectSend <= r1605 - Improper Authorization nuclei detection template
  • synacktiv.com https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • ProjectSend ProjectSend

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.