206 matches found
CVE-2025-49618
In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint...
CVE-2025-49618
In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint...
CVE-2025-49618
CVE-2025-49618 affects Plesk Obsidian 18.0.69. Unauthenticated requests to /login_up.php can disclose AWS credentials (accessKeyId, secretAccessKey, region, endpoint). Documented CVSSv3.1 base score 5.8 (Medium) with network attack vector, low attack complexity, no privileges required, and scope ...
PT-2025-27799 · Plesk · Plesk Obsidian
Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.69 Description: The issue allows unauthenticated requests to the "/login up.php" API endpoint to reveal sensitive AWS credentials, including accessKeyId, secretAccessKey, region, and endpoint. Recommendations: For...
CVE-2023-24044
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."...
CVE-2023-33244
Obsidian before 1.2.2 allows calls to unintended APIs for microphone access, camera access, and desktop notification via an embedded web page...
CVE-2023-27035
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...
CVE-2023-2110
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies tex...
CVE-2022-45130
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...
CVE-2022-36677
Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document...
CVE-2021-35976
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server...
CVE-2021-38148
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...
CVE-2022-36450
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL...
Obsidian Plugin Persistence
This module searches for Obsidian vaults for a user, and uploads a malicious community plugin to the vault. The vaults must be opened with community plugins enabled NOT restricted mode, but the plugin will be enabled automatically. Tested against Obsidian 1.7.7 on Kali, Ubuntu 22.04, and Windows...
CVE-2024-25639 Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients
Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting XSS via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by...
Exploit for Open Redirect in Plesk Obsidian
Badges !MIT Licensehttps://img.shields.io/badge/Licens...
Exploit for Embedded Malicious Code in Tukaani Xz
CVE-2024-3094 I've moved my notes in Obsidian to a separate v...
CVE-2022-36677
Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document...
