9.4Kritisch
WebPros Plesk extension "Site Import"
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
1.1%EPSS
Plesk Schwachstellen
Für WebPros Plesk veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.
CVEs gesamt22
Letzte 30 Tage0
Kritisch12
Ausgenutzt0
8.7Hoch
WebPros Plesk; WebPros Plesk extension "Plesk RESTful API"
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
8.7Hoch
WebPros Plesk extension "Ruby"; WebPros Plesk extension "Node.js Toolkit"
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
9.9Kritisch
WebPros Plesk
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
9.9Kritisch
WebPros Plesk
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
8.5Hoch
WebPros Plesk
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
9.0Kritisch
WebPros Plesk
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allo…
1.3%EPSS
8.7Hoch
WebPros Plesk Migrator; WebPros Plesk Site Import
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
9.9Kritisch
WebPros Plesk
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.
8.6Hoch
WebPros Plesk
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.
9.3Kritisch
WebPros Plesk
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.
9.9Kritisch
WebPros Plesk
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
7.7Hoch
WebPros Plesk
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.
9.9Kritisch
WebPros Plesk
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
9.9Kritisch
Webpros Plesk
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for…
9.9Kritisch
WebPros Plesk
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
9.9Kritisch
WebPros Plesk
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitra…
9.1Kritisch
7.8Hoch
Plesk Plesk
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."
6.3Mittel
Uncontrolled search path element vulnerability in Plesk
Plesk Plesk Installer
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll…
8.8Hoch
Cross-Site Scripting (XSS) vulnerability in Plesk
Plesk Plesk
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious …
8.8Hoch
plesk plesk
Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
2.0%EPSS
Die Liste enthält alle Einträge seit Anfang 2025 sowie ältere Einträge für dieses Produkt.