CVE-2024-11680

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

• CWE-306
• CWE-306

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yamlBroken Link, Third Party Advisory
• https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744Patch
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rbExploit
• https://vulncheck.com/advisories/projectsend-bypassThird Party Advisory
• https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdfMitigation, Technical Description, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680US Government Resource

Published

Nov 26, 2024

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11675A vulnerability has been found in CodeAstro Hospital Managem…5.4
• CVE-2024-11676A vulnerability was found in CodeAstro Hospital Management S…5.4
• CVE-2024-11677A vulnerability was found in CodeAstro Hospital Management S…5.4
• CVE-2024-11678A vulnerability was found in CodeAstro Hospital Management S…5.4
• CVE-2024-11679An input validation weakness was reported in the TpmSetup mo…6.7
• CVE-2024-1168The SEOPress – On-site SEO plugin for WordPress is vulnerabl…5.4
• CVE-2024-11681A malicious or compromised MacPorts mirror can execute arbit…6.9
• CVE-2024-11682The G Web Pro Store Locator plugin for WordPress is vulnerab…6.1
• CVE-2024-11683The Newsletter Subscriptions plugin for WordPress is vulnera…6.1
• CVE-2024-11684The Kudos Donations – Easy donations and payments with Molli…6.1
• CVE-2024-11685The `Kudos Donations – Easy donations and payments with Moll…6.1
• CVE-2024-11686The WhatsApp 🚀 click to chat plugin for WordPress is vulner…6.1