CVE-2026-58046

CriticalCVSS 9.9/10Last modified Oct 23, 2026

Description

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
WebPros	Plesk	< 18.0.79.4

References

https://support.plesk.com/hc/en-us/articles/42139500580119-Vulnerability-CVE-2026-58046-Blind-SQL-injection-in-Plesk-s-XML-RPC-API

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-580475.6HTTP Smuggling in cPanel allows potential leak of credentials.CVE-2026-580489.4Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.CVE-2026-580498.6FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-b CVE-2026-58057.3A weakness has been identified in code-projects Easy Blog Site up to 1.0. The impacted element is an unknown function of the file /users/con CVE-2026-580507.5libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation CVE-2026-580516.5libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so CVE-2026-580523.37-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppres CVE-2026-580539.9Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's Ho CVE-2026-580555.4nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable CVE-2026-580567.6RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfe CVE-2026-580575.0Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, w CVE-2026-580586.5Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc)