CVE-2021-45008

CVE-2021-45008 从普通用户到管理员的权限提升 受影响产品及版本：Plesk Obsidian 18.0.37 严重性：严重 影响：从普通用户获得管理员高权限，并访问关键信息 描述：不安全的权限漏洞，允许非特权用户获取管理员权限。 复现步骤： 1. 使用低权限用户账户登录 2. 使用 Burp 捕获请求 3. 注意 Super admin flag 参数为 false 4. 将请求转发至登录 5. 现在退出登录，重新输入凭据登录并捕获请求 6. 将 Super admin flag 参数的值从 false 改为 true，然后转发请求 7. 将看到更多信息，如银行账户及其他信...

CVE-2021-45007

CVE-2021-45007 跨站请求伪造 受影响的产品和版本：Plesk Obsidian 18.0.37 严重性：高 影响：提交带有攻击者信息的请求 描述：由于发送到服务器的请求中没有CSRFtoken保护，CSRF可能让攻击者提交新的请求。 复现步骤： 1. 登录并尝试提交任何请求 2. 使用Burp Suite捕获请求 3. 将注意到发送到服务器的请求中没有附带任何令牌保护 4. 编写简单的HTML漏洞利用代码来提交请求 5. 在浏览器中打开它 6. 提交请求 7. 将发现您的数据已成功提交...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

The Plesk control panel is affected by an untrusted search path vulnerability in versions 18.0.34 to 18.0.80.7 , 18.0.81 to 18.0.81.0 , and specifically within the Plesk RESTful API extension from version 2.4.2 to 2.4.6 . This flaw allows remote authenticated users to achieve arbitrary code execu...

CVE-2026-87898

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87898

A critical OS command injection vulnerability in Plesk allows remote authenticated users to execute arbitrary code with root privileges . The vulnerability has a CVSS 4.0 base score of 9.4 . While technical details regarding the specific vulnerable component or root cause are not explicitly provi...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

EUVD-2026-85621

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

EUVD-2026-85618

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87898: Improper Neutralization of Special Elements used in an OS Command

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

PT-2026-97570

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-68492: Untrusted Search Path

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

PT-2026-97571

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87886

CVE-2026-87886 is a local privilege escalation vulnerability caused by insecure default file permissions in three Acronis Backup Linux integrations: the cPanel & WHM plugin (before build 1.9.3.1021), the Plesk extension (before build 1.8.11.638), and the DirectAdmin plugin (before build 1.2.4.238...

The vulnerability of the backup and data restoration plugins on Acronis Backup software for computers and servers allows a hacker to escalate their privileges and execute arbitrary code. This vulnerability is present in programs like cPanel & WHM, Plesk.

The vulnerability of the backup and data restoration plugins on Acronis Backup software for computers and servers is related to improperly used standard permissions. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary code remotely...

CVE-2026-87886: Incorrect Default Permissions

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.9.3.1021, Acronis Backup extension for Plesk Linux before build 1.8.11.638, Acronis Backup plugin for DirectAdmin Linux before build...

Acronis Backup Incorrect Default Permissions Vulnerability

Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation...