Approved changes feed: RSS · Atom
cpe:2.3:a:webpros:plesk:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Webpros (3ebf8919-8933-5275-88f3-83c91ccd7db5) |
|---|---|
| Product | Plesk (00dfddea-2f52-55db-a02f-67168054fc5c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-56843 |
vulnerable | 2026-07-29 01:00:29.339149 |
Details available
CRITICAL (9.9)
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.
Published: 2026-07-08T00:15:43.120Z
Updated: 2026-07-08T13:04:17.023Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48614 |
vulnerable | 2026-07-29 00:55:01.560966 |
Details available
CRITICAL (9.9)
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
Published: 2026-07-06T16:46:05.644Z
Updated: 2026-07-06T17:39:05.008Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44962 |
vulnerable | 2026-06-08 08:05:11.390114 |
Details available
CRITICAL (9.9)
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
Published: 2026-05-29T15:41:23.795Z
Updated: 2026-08-14T15:02:39.531Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.