CVE-2021-45008

CVE-2021-45008 Escalada de privilegios de usuario a administrador Producto y versión afectados: Plesk Obsidian 18.0.37 Gravedad: Crítica Impacto: Obtener privilegios elevados de usuario a administrador y acceder a información crítica Descripción: vulnerabilidad de permisos inseguros que permite a...

CVE-2021-45007

CVE-2021-45007 Cross-Site Request Forgery Producto y versión afectados: Plesk Obsidian 18.0.37 Severidad: Alta Impacto: Enviar solicitudes con información del atacante Descripción: CSRF podría permitir al atacante enviar nuevas solicitudes porque no hay ninguna protección CSRFtoken enviada con la...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

The Plesk control panel is affected by an untrusted search path vulnerability in versions 18.0.34 to 18.0.80.7 , 18.0.81 to 18.0.81.0 , and specifically within the Plesk RESTful API extension from version 2.4.2 to 2.4.6 . This flaw allows remote authenticated users to achieve arbitrary code execu...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87898

A critical OS command injection vulnerability in Plesk allows remote authenticated users to execute arbitrary code with root privileges . The vulnerability has a CVSS 4.0 base score of 9.4 . While technical details regarding the specific vulnerable component or root cause are not explicitly provi...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

EUVD-2026-85621

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

EUVD-2026-85618

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

PT-2026-97570

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-68492: Untrusted Search Path

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-87898: Improper Neutralization of Special Elements used in an OS Command

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

PT-2026-97571

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87886

CVE-2026-87886 is a local privilege escalation vulnerability caused by insecure default file permissions in three Acronis Backup Linux integrations: the cPanel & WHM plugin (before build 1.9.3.1021), the Plesk extension (before build 1.8.11.638), and the DirectAdmin plugin (before build 1.2.4.238...

The vulnerability of the backup and data restoration plugins on Acronis Backup software for computers and servers allows a hacker to escalate their privileges and execute arbitrary code. This vulnerability is present in programs like cPanel & WHM, Plesk.

The vulnerability of the backup and data restoration plugins on Acronis Backup software for computers and servers is related to improperly used standard permissions. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary code remotely...

CVE-2026-87886: Incorrect Default Permissions

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.9.3.1021, Acronis Backup extension for Plesk Linux before build 1.8.11.638, Acronis Backup plugin for DirectAdmin Linux before build...

Acronis Backup Incorrect Default Permissions Vulnerability

Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation...