The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Arbitrary File Write as Root via Improper Link Resolution in cPanel

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.

Unauthenticated Data Leakage in cPanel Calendar and Contact Access

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

Arbitrary Perl Code Execution via Unvalidated Plugin Parameter in cPanel create_user

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Server‑Side Template Injection in SolusVM 2 Enabling Remote Code Execution

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

Arbitrary Command Execution via Multilang Adminbin Vulnerability

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Stored XSS Allowing Arbitrary Code Execution in WHM Mass Modify Accounts

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Stored XSS in WHM Manage SSL Hosts Allows Remote Code Execution

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Untrusted Search Path in Plesk RESTful API Allows Remote Execution as Root

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Local User Access to Other Accounts' CalDAV and CardDAV Data via Permission Misassignment

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

Remote Authenticated File Read and Code Execution via Argument Injection in WP Toolkit for cPanel

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

OS Command Injection Allowing Remote Authenticated Users to Execute Code with Root Privileges

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

An insufficient check allowed for the overwrite of arbitrary files via a symlink.

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Ruby: Node.js Toolkit: Plesk Extensions Ruby and Node.js Toolkit: Arbitrary Code Execution via Static Code Injection

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.