CVE-2026-44962
10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WebPros | Plesk | 18.0.75.1 < 18.0.75.1 | affected |
| WebPros | Plesk | 18.0.76.2 < 18.0.76.2 | affected |
Weaknesses
- CWE-643: CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.