CVE-2026-112002 in ProjectSend
الملخص
بحسب MITRE • 18/10/2026
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.