CVE-2026-58046 in Plesk

Sumário

de MITRE • 30/07/2026

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsável: Hackerone
• Reservar: 27/06/2026
• Divulgação: 30/07/2026
• Moderação: aceite
• Entrada: VDB-384622
• CPE: pronto
• CWE: CWE-89 (confirmado)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Telecommunication

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-58046
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58046
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-58046/