Read the docs
TI-2012-01351 Aliases CVE-2012-1557GHSA-rh68-87j9-wcfc

SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x…

Priority MEDIUM 42CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.

Why it matters now

EPSS 0.05824 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:parallels:parallels_plesk_panel:7.0:*:*:*:*:*:*:*7.0VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:7.6.1:*:*:*:*:*:*:*7.6.1VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:8.0:*:*:*:*:*:*:*8.0VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:8.1:*:*:*:*:*:*:*8.1VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:8.2:*:*:*:*:*:*:*8.2VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:8.3:*:*:*:*:*:*:*8.3VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:8.4:*:*:*:*:*:*:*8.4VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:8.6:*:*:*:*:*:*:*8.6VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:9.0:*:*:*:*:*:*:*9.0VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:9.2:*:*:*:*:*:*:*9.2VulnerableParallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:7.6.1:*:*:*:*:*:*:* Versions 7.6.1 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Parallels
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:parallels:parallels_plesk_panel:9.3:*:*:*:*:*:*:*9.3VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:9.5:*:*:*:*:*:*:*9.5VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:9.5.4:*:*:*:*:*:*:*9.5.4VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#10:*:*:*:*:*:*10.0.1 mu_\#10VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#11:*:*:*:*:*:*10.0.1 mu_\#11VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#2:*:*:*:*:*:*10.0.1 mu_\#2VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#3:*:*:*:*:*:*10.0.1 mu_\#3VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#5:*:*:*:*:*:*10.0.1 mu_\#5VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#7:*:*:*:*:*:*10.0.1 mu_\#7VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#10:*:*:*:*:*:*10.1.1 mu_\#10VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#11:*:*:*:*:*:*10.1.1 mu_\#11VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#12:*:*:*:*:*:*10.1.1 mu_\#12VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#13:*:*:*:*:*:*10.1.1 mu_\#13VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#15:*:*:*:*:*:*10.1.1 mu_\#15VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#16:*:*:*:*:*:*10.1.1 mu_\#16VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#17:*:*:*:*:*:*10.1.1 mu_\#17VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#18:*:*:*:*:*:*10.1.1 mu_\#18VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#19:*:*:*:*:*:*10.1.1 mu_\#19VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#20:*:*:*:*:*:*10.1.1 mu_\#20VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#1:*:*:*:*:*:*10.2.0 mu_\#1VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#10:*:*:*:*:*:*10.2.0 mu_\#10VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#11:*:*:*:*:*:*10.2.0 mu_\#11VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#12:*:*:*:*:*:*10.2.0 mu_\#12VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#2:*:*:*:*:*:*10.2.0 mu_\#2VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#3:*:*:*:*:*:*10.2.0 mu_\#3VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#4:*:*:*:*:*:*10.2.0 mu_\#4VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#5:*:*:*:*:*:*10.2.0 mu_\#5VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#7:*:*:*:*:*:*10.2.0 mu_\#7VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#8:*:*:*:*:*:*10.2.0 mu_\#8VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#9:*:*:*:*:*:*10.2.0 mu_\#9VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.3.1:mu_\#2:*:*:*:*:*:*10.3.1 mu_\#2VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.3.1:mu_\#3:*:*:*:*:*:*10.3.1 mu_\#3VulnerableParallels
cpe:2.3:a:parallels:parallels_plesk_panel:10.3.1:mu_\#4:*:*:*:*:*:*10.3.1 mu_\#4VulnerableParallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:9.3:*:*:*:*:*:*:* Versions 9.3 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:9.5:*:*:*:*:*:*:* Versions 9.5 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:9.5.4:*:*:*:*:*:*:* Versions 9.5.4 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#10:*:*:*:*:*:* Versions 10.0.1 mu_\#10 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#11:*:*:*:*:*:* Versions 10.0.1 mu_\#11 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#2:*:*:*:*:*:* Versions 10.0.1 mu_\#2 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#3:*:*:*:*:*:* Versions 10.0.1 mu_\#3 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#5:*:*:*:*:*:* Versions 10.0.1 mu_\#5 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.0.1:mu_\#7:*:*:*:*:*:* Versions 10.0.1 mu_\#7 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#10:*:*:*:*:*:* Versions 10.1.1 mu_\#10 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#11:*:*:*:*:*:* Versions 10.1.1 mu_\#11 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#12:*:*:*:*:*:* Versions 10.1.1 mu_\#12 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#13:*:*:*:*:*:* Versions 10.1.1 mu_\#13 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#15:*:*:*:*:*:* Versions 10.1.1 mu_\#15 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#16:*:*:*:*:*:* Versions 10.1.1 mu_\#16 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#17:*:*:*:*:*:* Versions 10.1.1 mu_\#17 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#18:*:*:*:*:*:* Versions 10.1.1 mu_\#18 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#19:*:*:*:*:*:* Versions 10.1.1 mu_\#19 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.1.1:mu_\#20:*:*:*:*:*:* Versions 10.1.1 mu_\#20 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#1:*:*:*:*:*:* Versions 10.2.0 mu_\#1 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#10:*:*:*:*:*:* Versions 10.2.0 mu_\#10 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#11:*:*:*:*:*:* Versions 10.2.0 mu_\#11 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#12:*:*:*:*:*:* Versions 10.2.0 mu_\#12 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#2:*:*:*:*:*:* Versions 10.2.0 mu_\#2 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#3:*:*:*:*:*:* Versions 10.2.0 mu_\#3 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#4:*:*:*:*:*:* Versions 10.2.0 mu_\#4 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#5:*:*:*:*:*:* Versions 10.2.0 mu_\#5 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#7:*:*:*:*:*:* Versions 10.2.0 mu_\#7 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#8:*:*:*:*:*:* Versions 10.2.0 mu_\#8 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.2.0:mu_\#9:*:*:*:*:*:* Versions 10.2.0 mu_\#9 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.3.1:mu_\#2:*:*:*:*:*:* Versions 10.3.1 mu_\#2 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.3.1:mu_\#3:*:*:*:*:*:* Versions 10.3.1 mu_\#3 Vulnerable ·Parallels
  • cpe:2.3:a:parallels:parallels_plesk_panel:10.3.1:mu_\#4:*:*:*:*:*:* Versions 10.3.1 mu_\#4 Vulnerable ·Parallels

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-1557
  2. 2026-10-03 Alias added: GHSA-rh68-87j9-wcfc

References

Advisory 1

Other 6

  • TI-2013-04282 The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small… CVSS 2.0HIGH 7.5
  • TI-2011-04089 The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a… CVSS 2.0HIGH 10.0
  • TI-2011-04084 The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect… CVSS 2.0HIGH 10.0
  • TI-2011-04083 The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the… CVSS 2.0HIGH 10.0
  • TI-2011-04079 The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password… CVSS 2.0HIGH 10.0
  • TI-2011-04073 The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 sends… CVSS 2.0HIGH 10.0
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences