CVE-2026-44962

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Scoring

Severity

CRITICAL

CVSS base score

9.9

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS probability

0.69%

CWE

CWE-643

Published

2026-05-29

Last modified

2026-08-14

Affected products

• WebPros Plesk
• WebPros Plesk
• WebPros Plesk

Weakness type

• CWE-643

Related vulnerabilities

• CVE-2026-9390 — XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
• CVE-2026-40699 — BIG-IP Configuration utility vulnerability
• CVE-2026-24343 — Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
• CVE-2025-11844 — XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
• CVE-2025-20218 — Cisco Secure Firepower Management Center Software XPATH Injection Vulnerability
• CVE-2022-43840 — IBM Aspera Console XPath injection
• CVE-2024-39565 — Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.
• CVE-2024-2648 — Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection

Markdown version · Browse all CVEs