CVE-2025-66430 | Critical | 9.1 | 2025-12-12 | Plesk 18.0 has Incorrect Access Control. |
CVE-2025-66431 | High | 7.8 | 2025-12-03 | WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. T… |
CVE-2025-49618 | Medium | 5.8 | 2025-07-03 | In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint. |
CVE-2023-4931 | Medium | 6.3 | 2023-11-27 | Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL file… |
CVE-2023-43784 | High | 7.5 | 2023-09-22 | Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there i… |
CVE-2023-0829 | High | 8.8 | 2023-09-20 | Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can full… |
CVE-2023-24044 | Medium | 6.1 | 2023-01-22 | A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request h… |
CVE-2022-45130 | Medium | 6.5 | 2022-11-10 | Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk… |
CVE-2021-45008 | High | 8.8 | 2022-02-21 | Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that… |
CVE-2021-45007 | Medium | 6.5 | 2022-02-20 | Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the ve… |
CVE-2021-35976 | Medium | 6.1 | 2021-09-10 | The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-6… |
CVE-2020-11584 | Medium | 6.1 | 2020-08-03 | A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parame… |
CVE-2020-11583 | Medium | 6.1 | 2020-08-03 | A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET pa… |
CVE-2001-1222 | | | 2002-03-25 | Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid accou… |