826 matches found
EUVD-2026-66761
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...
CVE-2026-65646
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...
CVE-2026-65647
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...
CVE-2026-65642
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
CVE-2026-65646
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...
CVE-2026-65642
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
CVE-2026-65647
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...
CVE-2026-65646
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...
CVE-2026-65647
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...
CVE-2026-65642
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
CVE-2026-65642
CVE-2026-65642 is an Insecure Direct Object Reference (IDOR) vulnerability in Plesk , affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3 . The flaw allows remote authenticated users to read and modify other customers' databases via the database management interface. The CVSS 4...
CVE-2026-65646
Plesk contains a vulnerability in its DNS zone management functionality caused by improper neutralization of special elements . Remote authenticated users can exploit this to disclose arbitrary local files and escalate privileges within the system. The CNA-assigned CVSS 3.0 score is 9.9 (Critical...
CVE-2026-65647
CVE-2026-65647 is an improper symlink resolution vulnerability in the Plesk Site Import and Migrator extensions. A remote authenticated (low-privilege) user can leverage this flaw to execute arbitrary code as root , resulting in full compromise of the vulnerable system. The CVSS 4.0 score is 8.7 ...
PT-2026-82316
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
PT-2026-82277
On Aug 25, @Plesk disclosed 3 flaws, all with fixes. CVE-2026-65647 can let an unprivileged Plesk user execute code as root. A panel update isn’t enough. Check: 🔷 Panel: 18.0.79.8 or 18.0.80.4 🔷 Migrator: 2.36.0 🔷 Site Import: 1.12.1 https://t.co/nZ4vI5KEqt...
CVE-2026-65642: Authorization Bypass Through User-Controlled Key
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
PT-2026-82317
Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...
CVE-2026-65646: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...
CVE-2026-65647: Improper Link Resolution Before File Access
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...
CVE-2026-64639
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...