⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI
60
CVE-2026-44962
- CVSS 3.1
- 9.9 critical
- EPSS
- <1%p51
- Published
- ·
- Modified
Description · NVD
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
- Weakness
- CWE-643
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H