CVE-2025-54336

In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...

PT-2025-33731

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.70 Description: The isAdminPasswordValid function in Plesk Obsidian uses a weak comparison == which allows an attacker to bypass the administrator password if the correct password is in the format "0e" followed by...

PT-2012-3666

Name of the Vulnerable Software and Affected Versions Newscoop versions 3.5.x through 3.5.4 Newscoop versions 4.x through 4 RC3 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the "Back" parameter to "admin/ad.php", or the token or f...