Plesk CVE-2020-11583

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medi

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to

The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via th

Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to e

SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inj

Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inje

Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise

Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-

Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper

Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.

Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. Rated critical severity (CVSS 9.0), this vu