ProjectSend version r582 suffers from a persistent cross site scripting vulnerability.