CVE-2023-53980

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
ProjectSend	projectSend	r1605

References

https://www.exploit-db.com/exploits/51238Exploit, Third Party Advisory
https://www.projectsend.org/Product
https://www.vulncheck.com/advisories/projectsend-remote-code-execution-via-file-extension-manipulationExploit, Third Party Advisory
https://www.exploit-db.com/exploits/51238Exploit, Third Party Advisory

Timeline

Published: Dec 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-539817.2PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through t CVE-2023-539827.5PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulat CVE-2023-539839.8Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Atta CVE-2023-539848.4Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged use CVE-2023-539856.1Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject maliciou CVE-2023-539868.6In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: disable RAC flush for TP1 RAC flush causes kerne CVE-2023-53987In the Linux kernel, the following vulnerability has been resolved: ping: Fix potentail NULL deref for /proc/net/icmp. After commit dbca15 CVE-2023-539887.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() Here is a BUG CVE-2023-53989In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and CVE-2023-53999.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of CVE-2023-539907.8In the Linux kernel, the following vulnerability has been resolved: SMB3: Add missing locks to protect deferred close file list cifs_del_d CVE-2023-53991In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Disallow unallocated resources to be returned In the even