CVE-2016-10732 ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users...
CriticalCVSS 9.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| projectsend | = 582 | No fix listed |
References
- github.com third-party-advisory