CVE-2026-64636

HighCVSS 7.7

Published: 07/08/2026(UTC)Updated: 07/08/2026(UTC)Translated: 08/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Risk Assessment

An authenticated user can access sensitive data stored in the panel database, potentially leading to confidentiality and integrity breaches.

Recommendation

Upgrade Plesk Obsidian to the latest version that includes a fix for the SQL injection vulnerability.

Other vulnerabilities in Plesk Obsidian

CVE-2025-65518High
A vulnerability in Plesk Obsidian versions 8.0.1 through 18.0.73 allows a DoS attack via the get_password.php endpoint. Sending a crafted request with a malicious payload causes continuous reloading of the web interface, making the service unavailable.

Original NVD description (English source)

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.