CVE-2026-44962

Katalog CVE

CVSS 9.9 · Critical EPSS 0,55%

Kerentanan Improper Neutralization of Data within XPath Expressions ('XPath Injection'). Skor CVSS 3.1 9.9 (Critical) menurut hackerone.com.

Deskripsi (NVD)

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

14 Agustus 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.9 (Critical), sumber hackerone.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://support.plesk.com/hc/en-us/articles/38633651286679-Vulnerability-CVE-2026-44962-in-Plesk-s-APS-Catalog