CVE-2016-10734: ProjectSend

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

Affected products

• ProjectSend ProjectSend: version 582 only

Published 2018-10-29. Last modified 2026-06-17.