Plesk
Monthly
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level account with shell access run OS command injection (CWE-78) to take over the entire hosting server. Any tenant permitted to use - or to toggle on - their own shell access can break out of their restricted account and reach the root identity, collapsing the isolation between shared-hosting customers and the host. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (CVSS 9.0) and has shipped fixed builds.
Injection via improper neutralization of special elements in Plesk's DNS zone management functionality enables remote authenticated users to read arbitrary local files and escalate privileges on the hosting server. Affecting all tracked versions of WebPros Plesk (CPE wildcard), this flaw combines information disclosure and privilege escalation into a single exploitable path, making it a high-impact post-authentication threat. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability warrant prompt remediation.
Cross-tenant insecure direct object reference in Plesk's database management interface allows any authenticated hosting panel customer to read and overwrite databases belonging to other customers on the same server, affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3. The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact with low attack complexity, consistent with the description: a valid tenant account and knowledge of another tenant's database identifier are all that is required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the multi-tenant hosting context amplifies real-world impact significantly.
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.80.2) lets a low-privileged panel user - a customer or reseller - abuse a flawed database cloning routine to run arbitrary code with the privileges of the database server administrator. Because Plesk multiplexes many tenants onto shared database infrastructure, this breaks tenant isolation and effectively hands a paying customer control of the shared DB admin context. No public exploit or CISA KEV listing has been identified; the vendor CVSS 4.0 score is 9.3 (Critical), though the vector's PR:N conflicts with the description's stated need for a low-privileged account.
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch.
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to enumerate domains belonging to other tenants through the XML-RPC API, because ownership checks are applied only to certain lookup filters and schema validation is skipped for legacy protocol versions. Because affected FTP credentials are stored in cleartext, an attacker retrieves another tenant's FTP password and can pivot to executing code as that tenant's system user. No public exploit has been identified at time of analysis, but the flaw was reported via HackerOne and carries a CVSS 9.9 rating.
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper authorization flaw in the XML API to inject arbitrary configuration directives, achieving arbitrary file write as root and full compromise of the underlying server. Rated CVSS 9.9 with a scope change, this turns any valid panel account into root on the host; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level account with shell access run OS command injection (CWE-78) to take over the entire hosting server. Any tenant permitted to use - or to toggle on - their own shell access can break out of their restricted account and reach the root identity, collapsing the isolation between shared-hosting customers and the host. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (CVSS 9.0) and has shipped fixed builds.
Injection via improper neutralization of special elements in Plesk's DNS zone management functionality enables remote authenticated users to read arbitrary local files and escalate privileges on the hosting server. Affecting all tracked versions of WebPros Plesk (CPE wildcard), this flaw combines information disclosure and privilege escalation into a single exploitable path, making it a high-impact post-authentication threat. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability warrant prompt remediation.
Cross-tenant insecure direct object reference in Plesk's database management interface allows any authenticated hosting panel customer to read and overwrite databases belonging to other customers on the same server, affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3. The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact with low attack complexity, consistent with the description: a valid tenant account and knowledge of another tenant's database identifier are all that is required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the multi-tenant hosting context amplifies real-world impact significantly.
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.80.2) lets a low-privileged panel user - a customer or reseller - abuse a flawed database cloning routine to run arbitrary code with the privileges of the database server administrator. Because Plesk multiplexes many tenants onto shared database infrastructure, this breaks tenant isolation and effectively hands a paying customer control of the shared DB admin context. No public exploit or CISA KEV listing has been identified; the vendor CVSS 4.0 score is 9.3 (Critical), though the vector's PR:N conflicts with the description's stated need for a low-privileged account.
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch.
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to enumerate domains belonging to other tenants through the XML-RPC API, because ownership checks are applied only to certain lookup filters and schema validation is skipped for legacy protocol versions. Because affected FTP credentials are stored in cleartext, an attacker retrieves another tenant's FTP password and can pivot to executing code as that tenant's system user. No public exploit has been identified at time of analysis, but the flaw was reported via HackerOne and carries a CVSS 9.9 rating.
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper authorization flaw in the XML API to inject arbitrary configuration directives, achieving arbitrary file write as root and full compromise of the underlying server. Rated CVSS 9.9 with a scope change, this turns any valid panel account into root on the host; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.