CVE-2026-53992
- Source
- https://cve.org/CVERecord?id=CVE-2026-53992
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53992.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-53992
- Published
- 2026-08-05T14:54:41.657Z
- Modified
- 2026-08-15T04:06:51.248328503Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
- Details
-
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53992.json", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "last_affected": "b4ad95b" } ] } ], "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-79" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53992.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-53992
- https://www.vulncheck.com/advisories/reflected-xss-in-projectsend-thumbnails-regenerate-php-via-start-date-end-date-parameters
- https://github.com/projectsend/projectsend/commit/b4ad95b1bd3d18b23261b7c3496bfbac8ebfe324
- https://github.com/projectsend/projectsend