CVE-2016-10732
CRITICALProjectSend r582 - Authentication Bypass via Direct Request
Title source: llmDescription
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/
Scores
CVSS v3
9.8
EPSS
0.0186
EPSS Percentile
76.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-287
Status
published
Products (1)
projectsend/projectsend
582
Published
Oct 29, 2018
Tracked Since
Feb 18, 2026