IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
9.9Crítica

CVE-2026-64637

WebPros Plesk Publicada: (hace 2 meses)

Descripción

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

Debilidad (CWE): CWE-269

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
WebPros Plesk < 18.0.80.1

Referencias y parches

CVE recientes del mismo producto — Plesk

8.7Alta
CVE-2026-68492
WebPros Plesk; WebPros Plesk extension "Plesk RESTful API"

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

9.4Crítica
CVE-2026-87898
WebPros Plesk extension "Site Import"

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

1.1%EPSS
8.7Alta
CVE-2026-68489
WebPros Plesk extension "Ruby"; WebPros Plesk extension "Node.js Toolkit"

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

9.9Crítica
CVE-2026-68487
WebPros Plesk

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

9.9Crítica
CVE-2026-68488
WebPros Plesk

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.

8.5Alta
CVE-2026-67397
WebPros Plesk

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.