CVE-2026-3977

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Mar 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-3977010.0Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.CVE-2026-397718.5Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.CVE-2026-397725.3Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.CVE-2026-3977310.0Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.CVE-2026-397748.8Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.CVE-2026-397758.8Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.CVE-2026-397768.0Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.CVE-2026-397787.1Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.CVE-2026-397794.3Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security CVE-2026-39788.8A vulnerability was detected in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formEasySetupWizard3. TCVE-2026-397807.1Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.CVE-2026-397817.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document