CVE-2025-65518

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-65518

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65518.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-65518

Published

2026-01-08T19:15:57.043Z

Modified

2026-03-15T14:54:12.541463Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65518.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "8.0.1"
            },
            {
                "fixed": "18.0.73"
            }
        ]
    }
]