CVE-2023-53905 - CVE House
Back to Database
Status published Medium CVE-2023-53905

ProjectSend r1605 CSV Injection via User Account Export Functionality

Vulnerability Description

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-53905

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Mirabbas Ağalarov

References

More from projectSend

View All →
CVE-2023-53930
ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability
High 7.1
CVE-2023-53906
ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page
Medium 5.1

Affected Vendor

projectSend

View all reports →

Affected Software

projectSend
Vulnerable Versions:
r1605

Timeline

Official Publish: December 17th, 2025
Last Modified: April 7th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1236

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.