Webpros Plesk
14 CVEs affecting Webpros Plesk. Latest disclosed: 2026-09-23. Critical: 8, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68488 | Critical | 9.9 | 2026-09-10 | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file… |
CVE-2026-68487 | Critical | 9.9 | 2026-09-10 | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. |
CVE-2026-65646 | Critical | 9.9 | 2026-08-26 | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files… |
CVE-2026-64637 | Critical | 9.9 | 2026-08-07 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root use… |
CVE-2026-58046 | Critical | 9.9 | 2026-07-30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Pl… |
CVE-2026-56843 | Critical | 9.9 | 2026-07-08 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own… |
CVE-2026-48614 | Critical | 9.9 | 2026-07-06 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary… |
CVE-2026-44962 | Critical | 9.9 | 2026-05-29 | Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queri… |
CVE-2026-64636 | High | 7.7 | 2026-08-07 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel databas… |
CVE-2026-68492 | | 2026-09-23 | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitra… | |
CVE-2026-67397 | | 2026-09-04 | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. | |
CVE-2026-67394 | | 2026-09-01 | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before… | |
CVE-2026-65642 | | 2026-08-26 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other custom… | |
CVE-2026-64639 | | 2026-08-12 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary… |