CVE-2016-5100
Froxlor guessable password reset token
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
- Record
CVE-2016-5100- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
CVE List No score
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
- Record
CVE-2016-5100- Updated
- 2026-11-02
EUVDEUVD-2022-4985 No score
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
- Record
EUVD-2022-4985- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qj6h-m7xc-r2v3
Froxlor guessable password reset token
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
- Record
GHSA-qj6h-m7xc-r2v3- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-330
- Updated
- 2026-11-02
OSV
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
- Record
CVE-2016-5100- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-qj6h-m7xc-r2v3
Froxlor guessable password reset token
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
- Record
GHSA-qj6h-m7xc-r2v3- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-330
- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0415-1 No score
Security update for froxlor
This update for froxlor fixes the following issues:
-
Upstream upgrade to version 0.10.23 (boo#846355)
-
Upstream upgrade to version 0.10.22 (boo#846355)
-
BuildRequire cron as this contains now the cron directories
-
Use %license for COPYING file instead of %doc [boo#1082318]
Upstream upgrade to version 0.9.40.1 (boo#846355)
new features besides API that found their way in:
- 2FA / TwoFactor Authentication for accounts
- MySQL8 compatibility
- new implementation of Let's Encrypt (acme.sh)
- customizable error/access log handling for webserver (format, level, pipe-to-script, etc.)
- lots and lots of bugfixes and small enhancements
Upstream upgrade to version 0.9.39.5 (boo#846355)
- PHP rand function for random number generation fixed in previous version (boo#1025193) CVE-2016-5100
- upstream upgrade to version 0.9.39 (boo#846355)
- Add and change of froxlor config files and manual
- Change Requires to enable use with php7
- Record
openSUSE-SU-2021:0415-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0450-1 No score
Security update for froxlor
This update for froxlor fixes the following issues:
-
Upstream upgrade to version 0.10.23 (boo#846355)
-
Upstream upgrade to version 0.10.22 (boo#846355)
-
BuildRequire cron as this contains now the cron directories
-
Use %license for COPYING file instead of %doc [boo#1082318]
Upstream upgrade to version 0.9.40.1 (boo#846355)
new features besides API that found their way in:
- 2FA / TwoFactor Authentication for accounts
- MySQL8 compatibility
- new implementation of Let's Encrypt (acme.sh)
- customizable error/access log handling for webserver (format, level, pipe-to-script, etc.)
- lots and lots of bugfixes and small enhancements
Upstream upgrade to version 0.9.39.5 (boo#846355)
- PHP rand function for random number generation fixed in previous version (boo#1025193) CVE-2016-5100
- upstream upgrade to version 0.9.39 (boo#846355)
- Add and change of froxlor config files and manual
- Change Requires to enable use with php7 This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0450-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
froxlor/froxlorPackagist |
before 0.9.35 | 0.9.35 |
froxloropenSUSE:Leap 15.2 |
before 0.10.23-lp152.4.3.1 | 0.10.23-lp152.4.3.1 |
froxlorSUSE:Package Hub 15 SP2 |
before 0.10.23-bp152.4.3.1 | 0.10.23-bp152.4.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-5100 is a critical vulnerability (CVSS 9.8) in Froxlor, published February 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 79th percentile. Fixed in froxlor/froxlor 0.9.35.