[ Vendor · 20 CVEs ]
froxlor
CVEs affecting froxlor published in the last 30 days, plus any froxlor CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-113676 | 20 Oct 2026 | CVSS 4.3 | froxlorFroxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any… | |
| CVE-2026-113677 | 20 Oct 2026 | CVSS 5.4 | froxlorFroxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated… | |
| CVE-2026-113678 | 20 Oct 2026 | CVSS 9.9 | froxlorFroxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take… | |
| CVE-2026-109960 | 13 Oct 2026 | CVSS 7.7 | froxlorFroxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by… | |
| CVE-2026-109961 | 13 Oct 2026 | CVSS 8.5 | froxlorFroxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the… | |
| CVE-2026-109962 | 13 Oct 2026 | CVSS 4.3 | froxlorFroxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and… | |
| CVE-2026-109963 | 13 Oct 2026 | CVSS 4.3 | froxlorFroxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail… | |
| CVE-2026-100719 | 26 Sep 2026 | CVSS 6.5 | froxlorFroxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password… | |
| CVE-2026-100720 | 26 Sep 2026 | CVSS 8.7 | froxlorFroxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL… | |
| CVE-2026-100713 | 26 Sep 2026 | CVSS 7.8 | froxlorFroxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron… | |
| CVE-2026-100714 | 26 Sep 2026 | CVSS 9.1 | froxlorFroxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the… | |
| CVE-2026-100715 | 26 Sep 2026 | CVSS 9.6 | froxlorFroxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8… | |
| CVE-2026-100716 | 26 Sep 2026 | CVSS 9.9 | froxlorFroxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate… | |
| CVE-2026-100717 | 26 Sep 2026 | CVSS 9.9 | froxlorfroxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only… | |
| CVE-2026-100718 | 26 Sep 2026 | CVSS 7.1 | froxlorFroxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled… | |
| CVE-2026-100708 | 26 Sep 2026 | CVSS 7.1 | froxlorFroxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the… | |
| CVE-2026-100709 | 26 Sep 2026 | CVSS 7.5 | froxlorFroxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the… | |
| CVE-2026-100710 | 26 Sep 2026 | CVSS 4.9 | froxlorFroxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin… | |
| CVE-2026-100711 | 26 Sep 2026 | CVSS 7.5 | froxlorfroxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers… | |
| CVE-2026-100712 | 26 Sep 2026 | CVSS 6.5 | froxlorfroxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management… |