critical · CVSS v3 9.8 · CVSS v4 9.2

CVE-2026-107246

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path…

Description

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
9.2
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-125358

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

View analysis

critical

CVE-2026-125370

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

View analysis

critical

CVE-2026-125383

INDOTALENT WHMS before 10.20261109 has an authentication bypass due to hard‑coded JWT signing key, issuer, and audience. Unauthenticated attackers can forge tokens and impersonate any user, including administrators. This flaw allows full control over the API.

View analysis

critical

CVE-2026-125384

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

View analysis