CVE-2026-64636

Full vulnerability record from the local CVENow database.

Description

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Severity

HIGH

CVSS score

7.7 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-08-07 18:17:20.070000

Last modified

2026-10-24 16:10:00.153000

View original CVE JSON

{
  "id": "CVE-2026-64636",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T18:17:20.070",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en Plesk Obsidian hasta 18.0.80 para Linux y Windows permite a un usuario autenticado leer datos arbitrarios de la base de datos del panel."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WebPros",
          "product": "Plesk",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "18.0.51",
              "lessThan": "18.0.80.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T18:23:29.520962Z",
          "id": "CVE-2026-64636",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.plesk.com/hc/en-us/articles/42431868205079",
      "source": "[email protected]"
    }
  ]
}