CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Score

CVSS 3.1 7.7 High

Status

Awaiting Analysis - support@hackerone.com

Published

2026-08-07

Last modified

2026-10-24

Weaknesses

CWE-89

Affected products

• Plesk (Webpros)

References

• https://support.plesk.com/hc/en-us/articles/42431868205079