What’s Vulnerable › Vulnerabilities

CVE-2025-49618

• Severity: medium (CVSS 5.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-03 · updated 2026-06-17
• Weakness: CWE-402

Description

In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.

Affected products

• Plesk Obsidian: 18.0.69

References

• https://www.linkedin.com/posts/gaetano-cesano-976420200_qualche-giorno-fa-stavo-testando-plesk-obsidian-activity-7341794923198709761-by9G
• https://www.plesk.com/blog/plesk-news-announcements/plesk-obsidian-18-0-69-is-here/

Get alerted when CVE-2025-49618 or the next vulnerability affects your stack