Threat database

CVE-2026-65643 is a high-severity vulnerability in WebPros cPanel versions up to 11.138.0.0 that allows remote authenticated users to execute arbitrary code as root via eval injection. This flaw involves improper neutralization of directives in dynamically evaluated code, enabling privilege escalation to root. Multiple version ranges of cPanel are affected, with no explicit patch information provided. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant risk if exploited.

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

CVE-2026-65642 is an Insecure Direct Object Reference (IDOR) vulnerability in WebPros Plesk versions 18.0.79.7 and earlier, as well as versions 18.0.80 through 18.0.80.3. This flaw allows remote authenticated users to read and modify databases belonging to other customers. The vulnerability has a high severity with a CVSS score of 8.6. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-65647 is a high-severity vulnerability in WebPros Plesk Migrator involving improper symbolic link resolution before file access. This flaw allows remote authenticated users to execute arbitrary code with root privileges. The vulnerability is categorized under CWE-59, indicating a link following issue. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

HTTP Smuggling in cPanel allows potential leak of credentials.

CVE-2026-58046 is a critical SQL injection vulnerability in the Plesk XML-RPC API. It allows a remote authenticated user with low privileges to perform SQL injection attacks, potentially reading arbitrary data from the Plesk database and leading to full compromise of the management panel.

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

CVE-2026-29206 is a high-severity SQL Injection vulnerability in WebPros cPanel affecting multiple versions. The issue arises from insufficient sanitization of SQL queries in the sqloptimizer utility script, which can be exploited if Slow Query logging is enabled. This vulnerability allows an attacker to perform SQL Injection with root user privileges, potentially leading to high impact on integrity and availability. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild at this time.

CVE-2026-32991 is a high-severity vulnerability in WebPros cPanel versions 11.110.0.0 through 11.136.0.0. It involves improper authorization checks that allow a team member to escalate their privileges to that of the team owner. The vulnerability has a CVSS 3.1 score of 7.