• The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
  • Debian 11 has reached its end-of-life (vendor EOL date - August 31, 2026). Plesk Obsidian 18.0.81 is the last release to support it.
    If you are running Plesk Obsidian on Debian 11, we recommend you upgrade those servers to Debian 12 using our dist-upgrade tool.
  • We plan to deprecate and remove the support for XML RPC protocol versions earlier than 1.6.9.1 in Plesk Obsidian 18.0.82. We strongly recommend that you update all existing integrations using earlier versions of the XML RPC protocol to comply with the version 1.6.9.1 specification.

Vulnerability in Plesk 7.5.*

B

BoXie

Guest
Hi ..

Probably known already .. but definitely NOT SAFE.

Issue:
--------
It is possible for admins / clients and domain owners to create a mailname with a mailbox WITHOUT a password.

When ignorant users do this .. spammers can take advantage of this to login to the SMTP service and use the server to spam. More worst case scenarios can be possible also i guess.

So please fix this asap ! But the option to make mailnames without a password and without a mailbox WOULD BE pretty handy i guess (for redirects).
 
You must log in or register to reply here.

Similar threads

T
Question How to Detect and Mitigate Next.js / React Vulnerabilities on Windows Plesk Server
Replies
0
Views
4K
teletek
T
T
Issue MSSQL restore warning in Plesk Backup Manager
Replies
7
Views
7K
Sebahat.hadzhi
Sebahat.hadzhi
TorbHo
Issue PHP TuxCare System Updates: ALT-PHP packages held back due to PHP-FPM dependency conflicts
Replies
4
Views
898
mow
M
A
Question Plesk Obsidian 18.0.81.4 on Ubuntu 24.04/OpenVZ: 1,742 abandoned popuser sessions in systemd-logind
Replies
2
Views
653
tessa67
tessa67
Hangover2
Critical security issue fixed on 24–25 February 2026 (Plesk Obsidian 18.0.75 Update 1 / 18.0.76 Update 2) — request for vulnerability details
Replies
4
Views
10K
Hangover2
Hangover2
Back
Top