CVE-2021-45008

CVE-2021-45008 从普通用户到管理员的权限提升 受影响产品及版本：Plesk Obsidian 18.0.37 严重性：严重 影响：从普通用户获得管理员高权限，并访问关键信息 描述：不安全的权限漏洞，允许非特权用户获取管理员权限。 复现步骤： 1. 使用低权限用户账户登录 2. 使用 Burp 捕获请求 3. 注意 Super admin flag 参数为 false 4. 将请求转发至登录 5. 现在退出登录，重新输入凭据登录并捕获请求 6. 将 Super admin flag 参数的值从 false 改为 true，然后转发请求 7. 将看到更多信息，如银行账户及其他信...

CVE-2021-45007

CVE-2021-45007 クロスサイト・リクエスト・フォージェリ 影響を受ける製品とバージョン: Plesk Obsidian 18.0.37 深刻度: 高 影響: 攻撃者の情報を含むリクエストを送信される可能性がある 説明: CSRFにより、サーバーに送信されるリクエストにCSRFtoken保護が含まれていないため、攻撃者が新しいリクエストを送信できる可能性があります。 再現手順: 1. ログインし、任意のリクエストを送信してみる 2. Burp Suiteでリクエストをキャプチャする 3. サーバーに送信されるリクエストにトークン保護が含まれていないことに気づく 4...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

EUVD-2026-54562

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

CVE-2026-64636

CVE-2026-64636 affects Plesk Obsidian up to version 18.0.80 on Linux and Windows. An SQL injection vulnerability allows an authenticated user to read arbitrary data from the panel database. According to the connected sources, the issue has a CVSS v3.1 base score of 7.7 (HIGH), with attack vector ...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

Plesk Obsidian 安全漏洞

Plesk Obsidian is a hosting control panel from the Swiss company Plesk. A security vulnerability exists in Plesk Obsidian versions 8.0.1 through 18.0.73, which stems from improper handling of malicious loads in the file getpassword.php, which could lead to a denial of service attack...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

PT-2026-1848

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73 Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service DoS condition. The issue resides in the get password.php API endpoint, where a specifically crafted...

CVE-2025-65518

Plesk Obsidian (versions 8.0.1 to 18.0.73) is affected by a Denial of Service in the get_password.php endpoint. A crafted, malicious request can cause the web interface to continuously reload, rendering the service unavailable to legitimate users. Exploitation is remote and does not require authe...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

EUVD-2020-3933

Malware in sbrugna...

EUVD-2021-22609

Malware in sbrugna...

EUVD-2022-48047

Malicious code in bioql PyPI...

EUVD-2025-19875

Malicious code in bioql PyPI...

EUVD-2025-25168

Malicious code in bioql PyPI...

CVE-2025-54336

In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...

CVE-2025-54336

In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...