plesk

Top products

The 14 most recently published vulnerabilities affecting plesk.

• CVE-2025-66430Plesk 18.0 has Incorrect Access Control.9.1Dec 12, 2025
• CVE-2025-66431WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage s...7.8Dec 3, 2025
• CVE-2025-49618In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.5.8Jul 3, 2025
• CVE-2023-4931Uncontrolled search path element vulnerability in Plesk6.3Nov 27, 2023
• CVE-2023-43784Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there is no security threat.7.5Sep 22, 2023
• CVE-2023-0829Cross-Site Scripting (XSS) vulnerability in Plesk8.8Sep 20, 2023
• CVE-2023-24044A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is ...6.1Jan 22, 2023
• CVE-2022-45130Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used th...6.5Nov 10, 2022
• CVE-2021-45008Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem o...8.8Feb 21, 2022
• CVE-2021-45007Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-s...6.5Feb 20, 2022
• CVE-2021-35976The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaS...6.1Sep 10, 2021
• CVE-2020-11583A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.6.1Aug 3, 2020
• CVE-2020-11584A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.6.1Aug 3, 2020
• CVE-2001-1222Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid account name for the domain.5.0Mar 15, 2002