CVE-2021-45008

CVE-2021-45008 Privilege Escalation from user to admin Affected product and version: Plesk Obsidian 18.0.37 Severity: Critical Impact: Gain high privilege from user to admin and access critical information Description: insecure permissions vulnerability that allows unprivilege user to get admin...

CVE-2021-45007

CVE-2021-45007 Cross-Site Request Forgery Affected product and version: Plesk Obsidian 18.0.37 Severity: High Impact: Submit requests with attacker information Description: CSRF could let the attacker to submit new requests because there isn’t any CSRFtoken protection sent with requests to server...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

EUVD-2026-54562

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

CVE-2026-64636

CVE-2026-64636 affects Plesk Obsidian up to version 18.0.80 on Linux and Windows. An SQL injection vulnerability allows an authenticated user to read arbitrary data from the panel database. According to the connected sources, the issue has a CVSS v3.1 base score of 7.7 (HIGH), with attack vector ...

PT-2026-69093

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions prior to 18.0.81 Description An SQL injection allows an authenticated user to read arbitrary data from the panel database. SQL injection is a type of flaw where an attacker can interfere with the queries that an...

CVE-2026-64636: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

Plesk Obsidian Login Panel - Detect

Plesk Obsidian login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Plesk Obsidian login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Plesk Obsidian Login Panel - Detect',...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The flaw exists in the get_password.php endpoint, where improper handling of malicious payloads allows a crafted request to cause the web interface to reload continuously. An unauthenticated remot...

Plesk Obsidian security vulnerabilities

Plesk Obsidian is a hosting control panel from the Swiss company Plesk. A security vulnerability exists in Plesk Obsidian versions 8.0.1 through 18.0.73, which stems from improper handling of malicious loads in the file getpassword.php, which could lead to a denial of service attack...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

CVE-2025-65518: Uncontrolled Resource Consumption

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

PT-2026-1848

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73 Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service DoS condition. The issue resides in the get password.php API endpoint, where a specifically crafted...

Plesk Obsidian Access Control RCE

The vulnerability of the Plesk Obsidian web hosting panel is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to the server with root privileges...