CVE-2025-66430

>= 18.0.70 and < 18.0.73.5

Plesk 18.0 has Incorrect Access Control.

9.1CRITICAL

CVE-2023-4931

all versions

Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitra

6.3MEDIUM

CVE-2023-43784

all versions

Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vend

7.5HIGH

CVE-2023-0829

>= 17.0 and <= 18.0.31

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or

8.8HIGH

CVE-2023-24044

<= 18.0.49

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious

6.1MEDIUM

CVE-2022-45130

all versions

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a

6.5MEDIUM

CVE-2021-45008

all versions

Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights.

8.8HIGH

CVE-2021-45007

all versions

Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user

6.5MEDIUM

CVE-2021-35976

>= 18.0.0 and <= 18.0.32

The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-s

6.1MEDIUM

CVE-2020-11584

all versions

A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript,

6.1MEDIUM

CVE-2020-11583

all versions

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScri

6.1MEDIUM

CVE-2008-6984

all versions

Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam

CVE-2007-4892

all versions

Multiple SQL injection vulnerabilities in SWSoft Plesk 7.6.1, 8.1.0, 8.1.1, and 8.2.0 for Windows allow remote attackers to execut

CVE-2007-2269

all versions

Directory traversal vulnerability in top.php3 in SWsoft Plesk for Windows 8.1 and 8.1.1 allows remote attackers to read arbitrary

CVE-2007-2268

all versions

Multiple directory traversal vulnerabilities in SWsoft Plesk for Windows 7.6.1, 8.1.0, and 8.1.1 allow remote attackers to read ar

CVE-2006-6451

<= 8.0.1

Multiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary w

CVE-2006-5028

all versions

Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows al

CVE-2004-2702

all versions

Cross-site scripting (XSS) vulnerability in login_up.php3 in Plesk 7.0 and 7.1 Reloaded allows remote attackers to inject arbitrar

CVE-2001-1222

all versions

Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's