CVE-2021-47947
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Stored XSS in Projectsend r1295. Authenticated attackers can inject malicious script via the 'name' parameter in files-edit.php, which executes for administrators on the Dashboard.
Risk Assessment
An attacker can take over an administrator account, steal data, or spread the attack within the system.
Recommendation
Update Projectsend to the latest version.
Original NVD description (English source)
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that execute in the browser when the file is viewed by other users, particularly affecting System Administrator users on the Dashboard page.