VULNERABILITY INTELLIGENCE

CVE-2023-53905

CVSS score8.8 HIGH

EPSS probability0.50%

CISA KEVNot currently listed

Published2025-12-17

Last modified2026-06-17

Description

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.