CVE-2025-54336
In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any o…
Published: 2025-08-19 · CVSS: 9.8 · CVSS 3.1
In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7