CVE-2015-2564: ProjectSend

Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days.

SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.

Affected products

• ProjectSend ProjectSend: version 561 only

Published 2015-03-20. Last modified 2026-06-17.