CVE-2024-11680

KEV Critical · CVSS 9.8

ProjectSend — Improper Authentication / Authentication Bypass leading to Unauthenticated RCE

CVSS: 9.8; nvd
EPSS: —
KEV: Listed; 2024-12-03
Class: oss containerizable; CWE-306, CWE-306

Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Search profile — drives PoC discovery

Symbols options.phpprojectsend_unauth_rce.rbprojectsend-auth-bypass.yamlr1720193367d937b1a59ed5b68dd4e60bd53317473744

Keywords CVE-2024-11680ProjectSendauthentication bypassoptions.phpunauthenticated RCEwebshell uploadimproper authenticationProjectSend r1720ProjectSend exploitProjectSend PoC

Versions: < r1720

Ranked PoCs (17) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

adysec/POC candidate

known researcher

trickest

★ 0
wy876/POC candidate

known researcher

trickest

★ 0
wy876/wiki candidate

known researcher

trickest

★ 0
D3N14LD15K/CVE-2024-11680_PoC_Exploit needs review

recent activity

gh_search · Shell

★ 11
12442RF/POC needs review

trickest

★ 0
DMW11525708/wiki needs review

trickest

★ 0
Lern0n/Lernon-POC needs review

trickest

★ 0
Linxloop/fork_POC needs review

trickest

★ 0
eeeeeeeeee-code/POC needs review

trickest

★ 0
fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0
greenberglinken/2023hvv_1 needs review

trickest

★ 0
iemotion/POC needs review

trickest

★ 0
laoa1573/wy876 needs review

trickest

★ 0
oLy0/Vulnerability needs review

trickest

★ 0
packetinside/CISA_BOT needs review

trickest

★ 0
qucklecrabik/CVE-2024-11680 needs review

recent activity

gh_search · Python

★ 0
ums91/CISA_BOT needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-15T00:00:20.000Z · profiled 2026-07-15T00:30:20.000Z