Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath querie…

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality. User-supplied input is interpolated into XPath queries without proper sanitization. This vulnerability allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server. The flaw results in local privilege escalation on affected Plesk installations. The vulnerability affects the search functionality within the APS Application Catalog component of Plesk.