-Infinity
0
Severity
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.

First published (updated )
Severity
7.7
SQL Injection
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

First published (updated )
Severity
9.9
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

First published (updated )
EOL
Oct 27, 2026

End of life: 10/27/2026, Latest version: 18.0.80.3

First published (updated )
Severity
9.9
SQL Injection
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.

First published (updated )
Severity
9.9
Code Injection
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

First published (updated )
EOL
Sep 23, 2026

End of life: 9/23/2026, Latest version: 18.0.79.7

First published (updated )
Severity
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

First published (updated )
EOL
Aug 4, 2026

End of life: 8/4/2026, Latest version: 18.0.78.5

First published (updated )
EOL
Jun 23, 2026

End of life: 6/23/2026, Latest version: 18.0.77.5

First published (updated )
EOL
May 11, 2026

End of life: 5/11/2026, Latest version: 18.0.76.6

First published (updated )
Severity
7

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.

First published (updated )
EOL
Mar 31, 2026

End of life: 3/31/2026, Latest version: 18.0.75.1

First published (updated )
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Plesk 18.0 has Incorrect Access Control.

First published (updated )
EOL
Feb 3, 2026

End of life: 2/3/2026, Latest version: 18.0.74.3

First published (updated )
EOL
Dec 23, 2025

End of life: 12/23/2025, Latest version: 18.0.73.5

First published (updated )
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.

First published (updated )
EOL
Nov 11, 2025

End of life: 11/11/2025, Latest version: 18.0.72.3

First published (updated )
EOL
Sep 30, 2025

End of life: 9/30/2025, Latest version: 18.0.71.2

First published (updated )
Severity
5.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.

First published (updated )
EOL
Aug 19, 2025

End of life: 8/19/2025, Latest version: 18.0.70.4

First published (updated )
EOL
Jul 8, 2025

End of life: 7/8/2025, Latest version: 18.0.69.4

First published (updated )
EOL
May 27, 2025

End of life: 5/27/2025, Latest version: 18.0.68.2

First published (updated )
EOL
Apr 15, 2025

End of life: 4/15/2025, Latest version: 18.0.67.3

First published (updated )
EOL
Mar 4, 2025

End of life: 3/4/2025, Latest version: 18.0.66.2

First published (updated )
EOL
Mar 4, 2025

End of life: 3/4/2025, Latest version: 18.0.66.2

First published (updated )
EOL
Jan 21, 2025

End of life: 1/21/2025, Latest version: 18.0.65.2

First published (updated )
EOL
Jan 21, 2025

End of life: 1/21/2025, Latest version: 18.0.65.2

First published (updated )
EOL
Dec 10, 2024

End of life: 12/10/2024, Latest version: 18.0.64.1

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203