CVE-2026-58046 in Plesk

Riassunto

di MITRE • 30/07/2026

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsabile: Hackerone
• Prenotare: 27/06/2026
• Divulgazione: 30/07/2026
• Moderazione: accettato
• Voce: VDB-384622
• CPE: pronto
• CWE: CWE-89 (confermato)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: molto basso
• Settore: Telecommunication

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-58046
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58046
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-58046/