Filtered by vendor Webpros Subscriptions
Filtered by product Plesk Subscriptions

Search

Switch to Advanced Search (Beta)
Total 10 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-67394 1 Webpros 1 Plesk 2026-09-01 N/A
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.
CVE-2026-65642 1 Webpros 1 Plesk 2026-08-27 8.1 High
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.
CVE-2026-65646 1 Webpros 1 Plesk 2026-08-27 8.8 High
Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges.
CVE-2026-64639 1 Webpros 1 Plesk 2026-08-14 N/A
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.
CVE-2026-44962 1 Webpros 1 Plesk 2026-08-14 9.9 Critical
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
CVE-2026-64637 1 Webpros 1 Plesk 2026-08-07 N/A
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
CVE-2026-64636 1 Webpros 1 Plesk 2026-08-07 7.7 High
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.
CVE-2026-58046 1 Webpros 1 Plesk 2026-08-02 9.9 Critical
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
CVE-2026-56843 1 Webpros 1 Plesk 2026-08-01 9.9 Critical
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.
CVE-2026-48614 1 Webpros 1 Plesk 2026-07-07 9.9 Critical
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.