How severe is CVE-2014-9567?

CVE-2014-9567 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2014-9567 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 43% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-9567?

CVE-2014-9567 primarily affects Projectsend. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-9567?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2014-9567 published?

CVE-2014-9567 was published on 2015-01-07 and last updated on 2026-06-17.

CVE-2014-9567

CVE-2014-9567 is a high-severity vulnerability in Projectsend with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 43% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-94.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 43% (99th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-94
Affected product: Projectsend
Published: 2015-01-07
Last modified: 2026-06-17

Description

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.

Frequently asked questions

What is CVE-2014-9567?: Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
How severe is CVE-2014-9567?: CVE-2014-9567 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2014-9567 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 43% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-9567?: CVE-2014-9567 primarily affects Projectsend. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-9567?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2014-9567 published?: CVE-2014-9567 was published on 2015-01-07 and last updated on 2026-06-17.

References

Affected products (15)

cpe:2.3:a:projectsend:projectsend:100:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:102:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:105:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:110:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:155:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:156:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:157:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:161:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:180:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:335:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:375:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:405:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:412:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:514:*:*:*:*:*:*:*
cpe:2.3:a:projectsend:projectsend:561:*:*:*:*:*:*:*

More vulnerabilities in Projectsend

CVE-2023-53980 — Critical (CVSS 9.8): ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by…
CVE-2024-11680 — Critical (CVSS 9.8): ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated…
CVE-2021-40887 — Critical (CVSS 9.8): Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for…
CVE-2016-10734 — Critical (CVSS 9.8): ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
CVE-2016-10733 — Critical (CVSS 9.8): ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
CVE-2016-10732 — Critical (CVSS 9.8): ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php,…

All CVEs affecting Projectsend →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →