CVE-2026-44962

9.9 Critique

Publiée le 29/05/2026 à 18:16 · Modifiée le 14/08/2026 à 18:16 · En attente d'analyse NVD · Source : support@hackerone.com

Description

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Traduire en français

Produits concernés

WebPros Plesk

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	support@hackerone.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-643

Références

https://support.plesk.com/hc/en-us/articles/38633651286679-Vulnerability-CVE-2026-44962-in-Plesk-s-APS-Catalog

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories