Skip to content
Plesk vulnerabilities
Newest
-
plesk, webpros plesk extension "plesk restful api" +1 more
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before...
CVE-2026-68492
8.7 High
-
plesk
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in...
CVE-2026-68488
9.9 Critical
-
plesk
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated...
CVE-2026-68487
9.9 Critical
-
plesk
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to...
CVE-2026-67397
8.5 High
-
plesk
A critical local privilege escalation via OS command injection vulnerability has been discovered...
CVE-2026-67394
9.0 Critical
-
plesk
Improper neutralization of special elements in Plesk allows remote authenticated users to...
CVE-2026-65646
9.9 Critical
-
plesk
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3,...
CVE-2026-65642
8.6 High
-
plesk
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a...
CVE-2026-64639
9.3 Critical
-
plesk
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated...
CVE-2026-64637
9.9 Critical
-
plesk
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an...
CVE-2026-64636
7.7 High
-
plesk
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged...
CVE-2026-58046
9.9 Critical
-
plesk
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low...
CVE-2026-56843
9.9 Critical
-
plesk
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to...
CVE-2026-48614
9.9 Critical
-
plesk
Plesk contains an XPath injection vulnerability in the APS Application Catalog search...
CVE-2026-44962
9.9 Critical
-
plesk
Plesk 18.0 has Incorrect Access Control.
CVE-2025-66430
9.1 Critical
-
plesk
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated...
CVE-2025-66431
7.8 High
-
plesk obsidian
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS...
CVE-2025-49618
5.8 Medium
-
plesk, plesk installer +1 more
Uncontrolled search path element vulnerability in Plesk
CVE-2023-4931
6.3 Medium
-
plesk onyx
** DISPUTED ** Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to...
CVE-2023-43784
Disputed
7.5 High
-
plesk
Cross-Site Scripting (XSS) vulnerability in Plesk
CVE-2023-0829
8.8 High
-
obsidian
Obsidian Local File Disclosure
CVE-2023-2110
8.2 High
-
plesk obsidian
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows...
CVE-2023-24044
Public exploitDisputed
6.1 Medium
-
plesk obsidian
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an...
CVE-2022-45130
6.5 Medium
-
plesk
Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege...
CVE-2021-45008
Public exploitDisputed
8.8 High
-
plesk
Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an...
CVE-2021-45007
Public exploitDisputed
6.5 Medium
-
plesk obsidian
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable...
CVE-2021-35976
6.1 Medium
-
plesk obsidian
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated...
CVE-2020-11583
6.1 Medium
-
plesk onyx
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users...
CVE-2020-11584
6.1 Medium
-
plesk server administrator
Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an...
CVE-2001-1222
5.0 Medium