Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
101 results · page 1 of 3
Sep 23, 2026OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-87898 · Other software · WebPros · reported by support@hackerone.comCritical 9.4
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
- Product
- Plesk extension "Site Import"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrarCVE-2026-68492 · Other software · WebPros · reported by support@hackerone.comHigh 8.7
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as CVE-2026-68489 · Other software · WebPros · reported by support@hackerone.comHigh 8.7
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
- Product
- Plesk extension "Ruby"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/CVE-2026-68488 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.CVE-2026-68487 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.CVE-2026-67397 · Other software · WebPros · reported by support@hackerone.comHigh 8.5
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before CVE-2026-67394 · Other software · WebPros · reported by support@hackerone.comCritical 9
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.CVE-2026-65647 · Other software · WebPros · reported by support@hackerone.comHigh 8.7
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
- Product
- Plesk Migrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files CVE-2026-65646 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customeCVE-2026-65642 · Other software · WebPros · reported by support@hackerone.comHigh 8.6
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary cCVE-2026-64639 · Other software · WebPros · reported by support@hackerone.comCritical 9.3
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root userCVE-2026-64637 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel databaseCVE-2026-64636 · Other software · WebPros · reported by support@hackerone.comHigh 7.7
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the PleCVE-2026-58046 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, CVE-2026-56843 · Other software · Webpros · reported by support@hackerone.comCritical 9.9
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary fCVE-2026-48614 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath querieCVE-2026-44962 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition.CVE-2025-65518 · Other software · Red Hat · reported by MITREHigh 7.5
Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.
- Product
- Red Hat OpenShift Dev Spaces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.plesk.comgithub.com
Dec 12, 2025Plesk 18.0 has Incorrect Access Control.CVE-2025-66430 · Websites & servers · Plesk · reported by MITRECritical 9.1
Plesk 18.0 has Incorrect Access Control.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.plesk.comsupport.plesk.com
Dec 3, 2025WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation.CVE-2025-66431 · Websites & servers · Plesk · reported by MITREHigh 7.8
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.plesk.comdocs.plesk.com
Aug 19, 2025In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison.CVE-2025-54336 · Other software · reported by MITRECritical 9.8
In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.aziz.tnsupport.plesk.com
Jul 3, 2025In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.CVE-2025-49618 · Websites & servers · Plesk · reported by MITREMedium 5.8
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0.CVE-2023-4931 · Websites & servers · Plesk · reported by cve-coordination@incibe.esMedium 6.3
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
- Product
- Plesk Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.plesk.comincibe.es
Sep 22, 2023Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component.CVE-2023-43784 · Websites & servers · Plesk · reported by MITREHigh 7.5
Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there is no security threat.
- Product
- Onyx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aws.amazon.comtalk.plesk.com
Sep 20, 2023Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting.CVE-2023-0829 · Websites & servers · Plesk · reported by cve-coordination@incibe.esHigh 8.8
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2023A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request heCVE-2023-24044 · Websites & servers · Plesk · reported by MITREMedium 6.1
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commedium.com
Nov 10, 2022Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password.CVE-2022-45130 · Websites & servers · Plesk · reported by MITREMedium 6.5
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidian"), not numbers.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortbridge.co.ukfortbridge.co.uk
Feb 21, 2022Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights.CVE-2021-45008 · Websites & servers · plesk · reported by MITREHigh 8.8
Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
- Product
- plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel.CVE-2021-45007 · Websites & servers · Plesk · reported by MITREMedium 6.5
Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62CVE-2021-35976 · Websites & servers · Plesk · reported by MITREMedium 6.1
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.plesk.comtarekbouali.com
Aug 3, 2020A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parametCVE-2020-11584 · Websites & servers · Plesk · reported by MITREMedium 6.1
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
- Product
- Onyx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2020A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parCVE-2020-11583 · Websites & servers · Plesk · reported by MITREMedium 6.1
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2019Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.CVE-2019-18793 · Other software · Parallels · reported by MITREMedium 6.1
Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 13, 2018The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog.CVE-2018-5693 · Computers, phones & browsers · Linuxmagic · reported by MITRELow 3.3
The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog.
- Product
- Magicspam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.wizard.cavulnerability-lab.com
Jul 18, 2013The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phpCVE-2013-4878 · Other software · Parallels · reported by MITREHigh 7.5
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comseclists.org
Apr 18, 2013Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATCVE-2013-0133 · Other software · Parallels · reported by cret@cert.orgHigh 7.2
Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Apr 18, 2013The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitraCVE-2013-0132 · Other software · Parallels · reported by cret@cert.orgMedium 6.8
The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Mar 12, 2012SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.CVE-2012-1557 · Other software · Parallels · reported by MITREHigh 7.5
SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload1.parallels.comdownload1.parallels.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackerCVE-2011-4856 · Other software · Parallels · reported by MITREHigh 9.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/health/parameters and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow reCVE-2011-4855 · Other software · Parallels · reported by MITREHigh 9.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/customer-service-plan/list/reset-search/true/ and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HCVE-2011-4854 · Other software · Parallels · reported by MITREHigh 9.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving the get_enabled_product_icon program. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain poCVE-2011-4853 · Other software · Parallels · reported by MITREMedium 4.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain other files.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings CVE-2011-4852 · Other software · Parallels · reported by MITREMedium 4.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it eaCVE-2011-4851 · Other software · Parallels · reported by MITREHigh 9.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easierCVE-2011-4850 · Other software · Parallels · reported by MITREMedium 4.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by help.php and certain other files.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remoCVE-2011-4849 · Other software · Parallels · reported by MITREMedium 4.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php and certain other files.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to CVE-2011-4848 · Other software · Parallels · reported by MITREMedium 4.3
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under client@1/domain@1/backup/local-repository/.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via CVE-2011-4847 · Other software · Parallels · reported by MITREHigh 7.5
SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Dec 16, 2011Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers tCVE-2011-4777 · Other software · Parallels · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2011Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitCVE-2011-4776 · Other software · Parallels · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.
- Product
- Parallels Plesk Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxss.cxexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.