CVE-2025-65518

HighCVSS 7.5

Published: 08/01/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

42th percentile - higher than 42% of all known CVEs

Summary

A vulnerability in Plesk Obsidian versions 8.0.1 through 18.0.73 allows a DoS attack via the get_password.php endpoint. Sending a crafted request with a malicious payload causes continuous reloading of the web interface, making the service unavailable.

Risk Assessment

Remote unauthenticated attacks can cause persistent unavailability of the Plesk management panel, disrupting server and hosting services.

Recommendation

Immediately upgrade Plesk Obsidian to a version later than 18.0.73 and deploy WAF rules to block suspicious requests to the get_password.php endpoint.

Other vulnerabilities in Plesk Obsidian

CVE-2026-64636High
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Original NVD description (English source)

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.