CVE-2025-66430Critical· 9.1▾ MidnightPlesk 18.0 has Incorrect Access Control.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Plesk 18.0 has Incorrect Access Control.
plesk >= 18.0.70, < 18.0.73.5plesk >= 18.0.74, < 18.0.74.2Upgrade past the affected range:
plesk 18.0.74.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-68492High· 8.7An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
CVE-2026-65646Critical· 9.9Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.
CVE-2026-68488Critical· 9.9A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
CVE-2026-68487Critical· 9.9Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
CVE-2013-10077Medium· 5.3OctoPrint API Key settings.py getSettings information disclosure
CVE-2025-10070Medium· 6.3Portabilis i-Educar enturmacao-em-lote access control