CVE-2023-53905: ProjectSend

High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days.

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.

Affected products

• ProjectSend ProjectSend: version r1605 only

Published 2025-12-17. Last modified 2026-06-17.