CVE-2017-9786

6.1 mediumEPSS 1.0%

Medium (6.1) in projectsend projectsend. EPSS 1.0% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

projectsend:projectsend

References

https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca
https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca

Check your stack JSON