SQL Injection

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack componentCVE-2026-67401WebPros · CVSS 9.9 · 0.9% likelycovered by CyberSIXT

   CWE-892 articles

2. Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leadin…CVE-2026-58046WebPros · CVSS 9.9 · 0.6% likely

   CWE-89

3. Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.CVE-2026-58048WebPros · CVSS 9.4 · 0.6% likelycovered by CyberSIXT

   CWE-89

4. An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.CVE-2026-64636WebPros · CVSS 7.7 · 0.4% likely

   CWE-89

5. Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.CVE-2026-29206WebPros · CVSS 8.1 · 0.3% likely

   CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.