CVE-2026-64636

State: Published
Severity: 7.7 High
Published: Aug 7, 2026
Updated: Aug 7, 2026
Reserved: Jul 20, 2026

Description

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	hackerone

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
PleskWebPros	18.0.51 to before 18.0.80.1Affected

References

https://support.plesk.com/hc/en-us/articles/42431868205079

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.