VULNERABILITY INTELLIGENCE

CVE-2023-53930

CVSS score7.5 HIGH

EPSS probability0.38%

CISA KEVNot currently listed

Published2025-12-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.

Weakness classification

disclosure@vulncheck.com: CWE-639

Primary references

disclosure@vulncheck.com — Exploit, Third Party Advisory
disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory