CVE-2014-9567: ProjectSend

High severity, CVSS 7.5. EPSS: 43.3% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.

Affected products

• ProjectSend ProjectSend: version 100 only; version 102 only; version 105 only; version 110 only; version 155 only; version 156 only; …

Published 2015-01-07. Last modified 2026-06-17.