687 matches found
CVE-2026-68489
A flaw was found in Plesk extensions Ruby and Node.js Toolkit. This static code injection vulnerability allows remote authenticated users to execute arbitrary code as root. The flaw is triggered by manipulating custom environment variables, leading to a complete compromise of the affected system...
CVE-2026-68489
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...
CVE-2026-68489
CVE-2026-68489 is a Static Code Injection vulnerability in two Plesk extensions: Ruby (before 1.6.6) and Node.js Toolkit (before 2.5.0). A remote authenticated user can execute arbitrary code as root by crafting malicious custom environment variables . The vulnerability scores 8.7 (HIGH) under CV...
EUVD-2026-78137
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...
CVE-2026-68489
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...
PT-2026-91729
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...
CVE-2026-68487
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
CVE-2026-68488
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
CVE-2026-68487
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
CVE-2026-68487
CVE-2026-68487 is a path traversal vulnerability in Plesk's Backup Manager caused by an unsigned backup header , allowing an authenticated customer to perform an arbitrary file write as root . The vulnerability is scored CVSS 9.9 (Critical) with a changed scope, reflecting high impact on confiden...
EUVD-2026-75596
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
CVE-2026-68488
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
EUVD-2026-75594
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
CVE-2026-68488
CVE-2026-68488 is a TOCTOU race condition in Plesk's Backup Manager that leads to insecure symlink following during restore operations. An attacker with low privileges can exploit this to take over ownership of arbitrary files or directories, resulting in local privilege escalation to root . The ...
CVE-2021-45008
CVE-2021-45008 从普通用户到管理员的权限提升 受影响产品及版本：Plesk Obsidian 18.0.37 严重性：严重 影响：从普通用户获得管理员高权限，并访问关键信息 描述：不安全的权限漏洞，允许非特权用户获取管理员权限。 复现步骤： 1. 使用低权限用户账户登录 2. 使用 Burp 捕获请求 3. 注意 Super admin flag 参数为 false 4. 将请求转发至登录 5. 现在退出登录，重新输入凭据登录并捕获请求 6. 将 Super admin flag 参数的值从 false 改为 true，然后转发请求 7. 将看到更多信息，如银行账户及其他信...
CVE-2021-45007
CVE-2021-45007 跨站请求伪造 受影响的产品和版本：Plesk Obsidian 18.0.37 严重性：高 影响：提交带有攻击者信息的请求 描述：由于发送到服务器的请求中没有CSRFtoken保护，CSRF可能让攻击者提交新的请求。 复现步骤： 1. 登录并尝试提交任何请求 2. 使用Burp Suite捕获请求 3. 将注意到发送到服务器的请求中没有附带任何令牌保护 4. 编写简单的HTML漏洞利用代码来提交请求 5. 在浏览器中打开它 6. 提交请求 7. 将发现您的数据已成功提交...
PT-2026-89495
New Plesk security alert: a symlink race condition in Backup Manager CVE-2026-68488 allows users with just FTP and panel access to gain root on Linux servers. Affects Plesk for Linux versions 18.0.80.6- and 18.0.79.10- branches. Patch to 18.0.80.7+ or 18.0.79.11+, especially if you run shared or...
PT-2026-89494
Warning: A critical path traversal vulnerability in Plesk Backup Manager allows arbitrary root file writes by authenticated customers. CVE-2026-68487 CVSS3.0: 9.9. Read the advisory https://t.co/GniZ2f5Oox and Patch Patch Patch...