Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Plesk extension "Plesk RESTful API" by WebPros

    CVE-2026-68492 (GCVE-0-2026-68492)

    Vulnerability from nvd – Published: 2026-09-23 19:52 – Updated: 2026-09-23 19:52
    VLAI
    Summary
    An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    WebPros Plesk Affected: 18.0.34 , < 18.0.80.8 (semver)
    Affected: 18.0.81 , < 18.0.81.1 (semver)
    		Create a notification for this product.
    WebPros Plesk extension "Plesk RESTful API" Affected: 2.4.2 , < 2.4.7 (semver)
    		Create a notification for this product.
    Credits
    Ali Mustafa (rz1027)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Plesk",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "18.0.80.8",
              "status": "affected",
              "version": "18.0.34",
              "versionType": "semver"
            },
            {
              "lessThan": "18.0.81.1",
              "status": "affected",
              "version": "18.0.81",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Plesk RESTful API\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "2.4.7",
              "status": "affected",
              "version": "2.4.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the \"Plesk RESTful API\" extension from 2.4.2 before 2.4.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.192Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43644058632983"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68492",
    "datePublished": "2026-09-23T19:52:47.192Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-23T19:52:47.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-68492 (GCVE-0-2026-68492)

    Vulnerability from cvelistv5 – Published: 2026-09-23 19:52 – Updated: 2026-09-23 19:52
    VLAI
    Summary
    An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    WebPros Plesk Affected: 18.0.34 , < 18.0.80.8 (semver)
    Affected: 18.0.81 , < 18.0.81.1 (semver)
    		Create a notification for this product.
    WebPros Plesk extension "Plesk RESTful API" Affected: 2.4.2 , < 2.4.7 (semver)
    		Create a notification for this product.
    Credits
    Ali Mustafa (rz1027)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Plesk",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "18.0.80.8",
              "status": "affected",
              "version": "18.0.34",
              "versionType": "semver"
            },
            {
              "lessThan": "18.0.81.1",
              "status": "affected",
              "version": "18.0.81",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Plesk RESTful API\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "2.4.7",
              "status": "affected",
              "version": "2.4.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the \"Plesk RESTful API\" extension from 2.4.2 before 2.4.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.192Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43644058632983"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68492",
    "datePublished": "2026-09-23T19:52:47.192Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-23T19:52:47.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}