Unrated severityNVD Advisory· Published Dec 16, 2011· Updated Apr 29, 2026

CVE-2011-4849

Description

The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php and certain other files.

Affected products

Parallels/Parallels Plesk Panel
cpe:2.3:a:parallels:parallels_plesk_panel:10.4.4_build20111103.18:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.htmlnvd
exchange.xforce.ibmcloud.com/vulnerabilities/72224nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000