CVE-2025-54336

critical · 9.8

In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.

9.8

CVSS

0.5%

EPSS (exploit prob.)

42nd

EPSS percentile

2025-08-19

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-697

References

https://blog.aziz.tn/2025/08/cve-2025-54336.html/
https://support.plesk.com/hc/en-us/articles/33785727869847-Vulnerability-CVE-2025-54336
https://www.plesk.com/blog/plesk-news-announcements/introducing-plesk-obsidian-18-0-70-anniversary-edition/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-54336