Webpros Plesk
10 CVEs affecting Webpros Plesk. Latest disclosed: 2026-09-01. Critical: 5, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64637 | Critical | 9.9 | 2026-08-07 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root use… |
CVE-2026-58046 | Critical | 9.9 | 2026-07-30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Pl… |
CVE-2026-56843 | Critical | 9.9 | 2026-07-08 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own… |
CVE-2026-48614 | Critical | 9.9 | 2026-07-06 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary… |
CVE-2026-44962 | Critical | 9.9 | 2026-05-29 | Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queri… |
CVE-2026-64636 | High | 7.7 | 2026-08-07 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel databas… |
CVE-2026-67394 | | 2026-09-01 | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before… | |
CVE-2026-65646 | | 2026-08-26 | Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges. | |
CVE-2026-65642 | | 2026-08-26 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other custom… | |
CVE-2026-64639 | | 2026-08-12 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary… |