Plesk Obsidian
5 CVEs affecting Plesk Obsidian. Latest disclosed: 2025-07-03. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45130 | Medium | 6.5 | 2022-11-10 | Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk… |
CVE-2023-24044 | Medium | 6.1 | 2023-01-22 | A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request h… |
CVE-2021-35976 | Medium | 6.1 | 2021-09-10 | The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-6… |
CVE-2020-11583 | Medium | 6.1 | 2020-08-03 | A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET pa… |
CVE-2025-49618 | Medium | 5.8 | 2025-07-03 | In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint. |