PROJECTSEND CVE-2024–11680 EXPLOITED IN THE WILD

Summary from the TLDR InfoSec newsletter

ProjectSend is a moderately popular open source web application for hosting file-sharing servers. An authentication bypass vulnerability that was discovered in January 2023 and has had Nuclei and Metasploit templates available for months has just been assigned a CVE. The delay in the assignment of the CVE is problematic as VulnCheck researchers have noted only 1% of servers being patched and evidence of active exploitation on many others.