Description

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.

Remediation

References

CVE-2023-53930

Related Vulnerabilities

WordPress Plugin Google Alert And Twitter Multiple Vulnerabilities (3.1.5)

jQuery UI Dialog Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41183)

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Multiple Cross-Site Scripting Vulnerabilities (2.8.8)

Oracle JRE CVE-2013-5777 Vulnerability (CVE-2013-5777)

OpenSSL Improper Validation of Integrity Check Value Vulnerability (CVE-2026-34181)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-639 CVE-2023-53930