Description
Multiple vulnerabilities were reported in Parallels Plesk Sitebuilder. Parallels Plesk comes with an ISAPI filter named sitepreview.dll. This filter can be abused to bypass the firewall restrictions and access the Sitebuilder interface on port 2006. Using this interface an attacker can upload and execute arbitrary code.
Remediation
Upgrade to the latest version of Parallels Plesk.
References
Related Vulnerabilities
WordPress Plugin Lightbox Jquery Possible Remote Code Execution (0.24)
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-29211)
Rails remote code execution using render :inline
WordPress Plugin All-in-One WP Migration Remote Code Execution (2.0.2)
Deserialization of Untrusted Data (.NET BinaryFormatter Object Deserialization)