CVE-2021-45007

CVE-2021-45007 Cross-Site Request Forgery Affected product and version: Plesk Obsidian 18.0.37 Severity: High Impact: Submit requests with attacker information Description: CSRF could let the attacker to submit new requests because there isn’t any CSRFtoken protection sent with requests to server...

CVE-2021-45008

CVE-2021-45008 Privilege Escalation from user to admin Affected product and version: Plesk Obsidian 18.0.37 Severity: Critical Impact: Gain high privilege from user to admin and access critical information Description: insecure permissions vulnerability that allows unprivilege user to get admin...

CVE-2026-82977

The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure...

EUVD-2026-124553

The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure...

CVE-2026-82977

The Plesk GoAccess statistics integration in Plesk Obsidian for Linux is vulnerable to cross-subscription information disclosure in versions 18.0.77 to 18.0.81.7 and 18.0.82 to 18.0.82.2 . The root cause involves incorrect permission assignment for critical resources (CWE-732). This flaw allows f...

CVE-2026-107246

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

EUVD-2026-120631

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

CVE-2026-107246

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

CVE-2026-107246

The Plesk extension "Site Import" (versions before 1.13.2 ) is vulnerable to a path traversal flaw due to improper validation of domain and session identifiers. An attacker with a non-owner subscription can redirect a privileged backend session into a directory they control. This vulnerability ca...

PT-2026-141241

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

CVE-2026-107246: WebPros Plesk extension "Site Import": The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing…

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

PT-2026-113758

Forgot to share this here, I wrote an analysis of the Plesk CVE-2025-6630 vulnerability. https://t.co/mP7FDdqWNP...

Acronis Backup CVE-2026-87886 Detect

Detects Acronis Backup integrations on cPanel/WHM, Plesk, or DirectAdmin that may be affected by CVE-2026-87886 insecure file permissions enabling local privilege escalation. Fingerprints the plugin surface and parses build numbers against fixed releases cPanel 1.9.3.1021, Plesk 1.8.11.638,...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

The Plesk control panel is affected by an untrusted search path vulnerability in versions 18.0.34 to 18.0.80.7 , 18.0.81 to 18.0.81.0 , and specifically within the Plesk RESTful API extension from version 2.4.2 to 2.4.6 . This flaw allows remote authenticated users to achieve arbitrary code execu...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-87898

A critical OS command injection vulnerability in Plesk allows remote authenticated users to execute arbitrary code with root privileges . The vulnerability has a CVSS 4.0 base score of 9.4 . While technical details regarding the specific vulnerable component or root cause are not explicitly provi...