CriticalCVSS 9.1
EPSS 0.55%
Plesk 18.0 has Incorrect Access Control.
Vendor
plesk vulnerabilities
10 published CVES affecting plesk, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 10
- Critical
- 2
- High
- 2
- Medium
- 6
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest plesk CVEs
Newest publication first
-
-
HighCVSS 7.8 EPSS 0.27%
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."
-
MediumCVSS 5.8 EPSS 0.40%
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.
-
HighCVSS 7.8 EPSS 0.25%
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon....
-
CriticalCVSS 9.0 EPSS 0.66%
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.
-
MediumCVSS 6.5 EPSS 0.45%
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identifi...
-
MediumCVSS 6.1 EPSS 1.1%
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the...
-
MediumCVSS 6.1 EPSS 1.0%
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
-
MediumCVSS 6.1 EPSS 0.91%
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
-
MediumCVSS 5.0 EPSS 1.6%
Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid account name for the domain.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.