~/security / plesk
Plesk: ultime vulnerabilità
Le CVE più recenti per Plesk, ogni giorno dalla NVD. Le descrizioni provengono dal database (in inglese).
| CVE | Pubblicata | Gravità | Descrizione |
|---|---|---|---|
| CVE-2026-87898 | 23 settembre 2026 | critica 9.4 | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. |
| CVE-2026-68492 | 23 settembre 2026 | alta 8.7 | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7. |
| CVE-2026-87886 | 17 settembre 2026 | alta 7.8 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin … |
| CVE-2026-68489 | 14 settembre 2026 | alta 8.7 | Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables. |
| CVE-2026-68488 | 10 settembre 2026 | critica 9.9 | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover. |
| CVE-2026-68487 | 10 settembre 2026 | critica 9.9 | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. |
| CVE-2026-67397 | 4 settembre 2026 | alta 8.5 | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. |
| CVE-2026-67394 | 1 settembre 2026 | critica 9.0 | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allow… |
| CVE-2026-65647 | 26 agosto 2026 | alta 8.7 | Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root. |
| CVE-2026-65646 | 26 agosto 2026 | critica 9.9 | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges. |
| CVE-2026-65642 | 26 agosto 2026 | alta 8.6 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases. |
| CVE-2026-64639 | 12 agosto 2026 | critica 9.3 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator. |
| CVE-2026-64637 | 7 agosto 2026 | critica 9.9 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account. |
| CVE-2026-64636 | 7 agosto 2026 | alta 7.7 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database. |
| CVE-2026-58046 | 30 luglio 2026 | critica 9.9 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel. |
| CVE-2026-56843 | 8 luglio 2026 | critica 9.9 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for … |
| CVE-2026-48614 | 6 luglio 2026 | critica 9.9 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server. |
Nuovi articoli via e-mail
Un'e-mail per ogni nuovo articolo. Nessun tracciamento, puoi annullare quando vuoi. Come ringraziamento dopo la conferma: la mia checklist “Gestione server e patching” (PDF).