Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting

Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of...

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. id: CVE-2022-30777 info: name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting author: 3th1cyuk1 severity: medium description: | Parallels H-Sphere 3.6.1713 contains a cross-site...

parallels-plist-escape

parallels-plist-escape This repository contains exploits for CVE-2023-27327 and CVE-2023-27328, which can be used together to escape a Parallels Desktop virtual machine, prior to Parallels Desktop 18.1.1. It also contains code for a required kernel module, in prlmod, which can be used to send...

CVE-2023-27326

Parallels Desktop VM Escape This repository contains an exploit for a Parallels Desktop vulnerability which has been assigned CVE-2023-27326. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. The exploit was tested on Parallels Deskto...

CVE-2023-27326

Parallels Desktop VM Escape This repository contains an exploit for a Parallels Desktop vulnerability which has been assigned CVE-2023-27326. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. The exploit was tested on Parallels Deskto...

parallels-file-move-privesc

parallels-file-move-privesc This repository contains an exploit for CVE-2023-50226 / ZDI-CAN-21227, which can be used to escalate privileges to root using Parallels Desktop on versions before 18.3.2...

CVEs

Responsible Disclosure: As stated in the description. Should exploits work against a live version of a product, the vendor was contacted multiple times and given 90 days to fix the issue. They either 1. Did not reply to any of my emails or 2. Took too long to fix it and was unresponsive in lettin...

CVE-2026-116737

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename t...

UBUNTU-CVE-2026-116737

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename t...

CVE-2026-116737 libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename t...

CVE-2026-116737 libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename t...

PT-2026-125486

Name of the Vulnerable Software and Affected Versions libphdi versions prior to 20260902 Description A heap out-of-bounds read occurs in the libphdi data files get extent data file path function. The issue arises because the function utilizes the directory prefix length rather than the basename...

Parallels Desktop < 27.0.0 Local Privilege Escalation (macOS)

The version of Parallels Desktop installed on the remote macOS host is prior to 27.0.0. It is, therefore, affected by a privilege escalation vulnerability: - Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket...

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week. The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix i...

CVE-2026-90894

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894

Parallels Desktop (macOS) contains a local privilege escalation vulnerability in the prl_disp_service daemon, which runs as root . Local clients reach it via a world-writable socket, and PrlSrv_LoginLocal accepts peer credentials with no signature or admin-group check. After login, PrlSrv_Install...

EUVD-2026-77346

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

PT-2026-91137

Name of the Vulnerable Software and Affected Versions Parallels Desktop versions prior to 27.0.0 Description A local privilege escalation issue exists in Parallels Desktop for Mac where an unprivileged local user can execute code as root. The prl disp service daemon runs with root privileges and...