CVE-2021-35976

The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.

• CWE-79

• https://support.plesk.com/hc/en-us/articles/4402990507026Vendor Advisory
• https://tarekbouali.com/cves/cve-2021-35976Exploit, Third Party Advisory
• https://www.bouali.io/cves/cve-2021-35976Broken Link
• https://support.plesk.com/hc/en-us/articles/4402990507026Vendor Advisory
• https://tarekbouali.com/cves/cve-2021-35976Exploit, Third Party Advisory
• https://www.bouali.io/cves/cve-2021-35976Broken Link

Published

Sep 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35969Pexip Infinity before 26 allows temporary remote Denial of S…7.5
• CVE-2021-3597A flaw was found in undertow. The HTTP2SourceChannel fails t…5.9
• CVE-2021-35970Talk 4 in Coral before 4.12.1 allows remote attackers to dis…7.5
• CVE-2021-35971Veeam Backup and Replication 10 before 10.0.1.4854 P20210609…9.8
• CVE-2021-35973NETGEAR WAC104 devices before 1.0.4.15 are affected by an au…9.8
• CVE-2021-35975Absolute path traversal vulnerability in the Systematica SMT…5.3
• CVE-2021-35977An issue was discovered in Digi RealPort for Windows through…9.8
• CVE-2021-35978An issue was discovered in Digi TransPort DR64, SR44 VC74, a…9.8
• CVE-2021-35979An issue was discovered in Digi RealPort through 4.8.488.0. …8.1
• CVE-2021-3598There's a flaw in OpenEXR's ImfDeepScanLineInputFile functio…5.5
• CVE-2021-35980Acrobat Reader DC versions 2021.005.20054 (and earlier), 202…7.8
• CVE-2021-35981Acrobat Reader DC versions 2021.005.20054 (and earlier), 202…7.8