CVE-2021-40888

Name of the Vulnerable Software and Affected Versions Projectsend version r1295

Description The issue is caused by a lack of sanitization when echoing output data in the returnFilesIds() function, allowing a low privilege user to execute scripting code through the process.php file. This is a Cross Site Scripting (XSS) issue.

Recommendations For Projectsend version r1295, consider disabling the returnFilesIds() function until a patch is available to prevent exploitation. Restrict access to the process.php file to minimize the risk of scripting code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.