Lucene search
+L

68 matches found

Kitploit
Kitploit
added 2026/09/03 12:45 a.m.4 views

CVE-2021-45008

CVE-2021-45008 从普通用户到管理员的权限提升 受影响产品及版本:Plesk Obsidian 18.0.37 严重性:严重 影响:从普通用户获得管理员高权限,并访问关键信息 描述:不安全的权限漏洞,允许非特权用户获取管理员权限。 复现步骤: 1. 使用低权限用户账户登录 2. 使用 Burp 捕获请求 3. 注意 Super admin flag 参数为 false 4. 将请求转发至登录 5. 现在退出登录,重新输入凭据登录并捕获请求 6. 将 Super admin flag 参数的值从 false 改为 true,然后转发请求 7. 将看到更多信息,如银行账户及其他信...

8.8CVSS7.3AI score0.01959EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/03 12:45 a.m.8 views

CVE-2021-45007

CVE-2021-45007 跨站请求伪造 受影响的产品和版本:Plesk Obsidian 18.0.37 严重性:高 影响:提交带有攻击者信息的请求 描述:由于发送到服务器的请求中没有CSRFtoken保护,CSRF可能让攻击者提交新的请求。 复现步骤: 1. 登录并尝试提交任何请求 2. 使用Burp Suite捕获请求 3. 将注意到发送到服务器的请求中没有附带任何令牌保护 4. 编写简单的HTML漏洞利用代码来提交请求 5. 在浏览器中打开它 6. 提交请求 7. 将发现您的数据已成功提交...

6.5CVSS6.6AI score0.00731EPSS
SaveExploits1
NVD
NVD
added 2026/08/07 6:17 p.m.10 views

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

7.7CVSS0.00252EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/07 5:57 p.m.12 views

EUVD-2026-54562

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

7.7CVSS5.7AI score0.00252EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/07 5:57 p.m.32 views

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

7.7CVSS0.00252EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/07 5:57 p.m.136 views

CVE-2026-64636

CVE-2026-64636 affects Plesk Obsidian up to version 18.0.80 on Linux and Windows. An SQL injection vulnerability allows an authenticated user to read arbitrary data from the panel database. According to the connected sources, the issue has a CVSS v3.1 base score of 7.7 (HIGH), with attack vector ...

7.7CVSS5.7AI score0.00252EPSS
SaveExploits0References1
NVD
NVD
added 2026/01/08 7:15 p.m.15 views

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

7.5CVSS0.00581EPSS
SaveExploits0References5
OSV
OSV
added 2026/01/08 7:15 p.m.12 views

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

7.5CVSS5.8AI score0.00581EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2026/01/08 12:00 a.m.14 views

Plesk Obsidian 安全漏洞

Plesk Obsidian is a hosting control panel from the Swiss company Plesk. A security vulnerability exists in Plesk Obsidian versions 8.0.1 through 18.0.73, which stems from improper handling of malicious loads in the file getpassword.php, which could lead to a denial of service attack...

7.5CVSS6.5AI score0.00581EPSS
SaveExploits0References3
CVE
CVE
added 2026/01/08 12:00 a.m.38 views

CVE-2025-65518

Plesk Obsidian (versions 8.0.1 to 18.0.73) is affected by a Denial of Service in the get_password.php endpoint. A crafted, malicious request can cause the web interface to continuously reload, rendering the service unavailable to legitimate users. Exploitation is remote and does not require authe...

7.5CVSS6.4AI score0.00581EPSS
SaveExploits0References5Affected Software1
Vulnrichment
Vulnrichment
added 2026/01/08 12:00 a.m.6 views

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

6.4AI score0.00581EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/01/08 12:00 a.m.20 views

PT-2026-1848

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73 Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service DoS condition. The issue resides in the get password.php API endpoint, where a specifically crafted...

7.5CVSS6.7AI score0.00581EPSS
SaveExploits0References12
Cvelist
Cvelist
added 2026/01/08 12:00 a.m.50 views

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service DoS condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service...

0.00581EPSS
SaveExploits0References2
EUVD
EUVD
added 2025/10/07 12:30 a.m.12 views

EUVD-2020-3933

Malware in sbrugna...

6.1CVSS6.3AI score0.01017EPSS
SaveExploits0References3
EUVD
EUVD
added 2025/10/07 12:30 a.m.14 views

EUVD-2021-22609

Malware in sbrugna...

6.1CVSS6.3AI score0.01148EPSS
SaveExploits1References4
EUVD
EUVD
added 2025/10/03 8:07 p.m.15 views

EUVD-2022-48047

Malicious code in bioql PyPI...

6.5CVSS6.6AI score0.0034EPSS
SaveExploits1References2
EUVD
EUVD
added 2025/10/03 8:07 p.m.14 views

EUVD-2025-25168

Malicious code in bioql PyPI...

9.8CVSS6.6AI score0.0051EPSS
SaveExploits0References3
EUVD
EUVD
added 2025/10/03 8:07 p.m.20 views

EUVD-2025-19875

Malicious code in bioql PyPI...

5.8CVSS6.6AI score0.00349EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2025/08/21 12:26 a.m.17 views

CVE-2025-54336

In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...

9.8CVSS7.3AI score0.0051EPSS
SaveExploits0References1
NVD
NVD
added 2025/08/19 2:15 p.m.18 views

CVE-2025-54336

In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...

9.8CVSS0.0051EPSS
SaveExploits0References3
Rows per page
Query Builder