IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.7Hoch

CVE-2026-68492

WebPros Plesk; WebPros Plesk extension "Plesk RESTful API" Veröffentlicht: (vor 1 Monat)

Beschreibung

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Schwachstellentyp (CWE): CWE-426

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
WebPros Plesk 18.0.34 – < 18.0.80.8, 18.0.81 – < 18.0.81.1
WebPros Plesk extension "Plesk RESTful API" 2.4.2 – < 2.4.7

Referenzen und Patches

Neue CVEs im selben Produkt — Plesk

9.4Kritisch
CVE-2026-87898
WebPros Plesk extension "Site Import"

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

1.1%EPSS
8.7Hoch
CVE-2026-68489
WebPros Plesk extension "Ruby"; WebPros Plesk extension "Node.js Toolkit"

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

9.9Kritisch
CVE-2026-68487
WebPros Plesk

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

9.9Kritisch
CVE-2026-68488
WebPros Plesk

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.

8.5Hoch
CVE-2026-67397
WebPros Plesk

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

9.0Kritisch
CVE-2026-67394
WebPros Plesk

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allo…

1.3%EPSS