Skip to content
Froxlor vulnerabilities
Newest
-
froxlor
Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
CVE-2026-121436
8.6 High
-
froxlor
Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
CVE-2026-121435
5.3 Medium
-
froxlor
Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API
CVE-2026-121434
5.3 Medium
-
froxlor
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
CVE-2026-113678
9.4 Critical
-
froxlor
Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
CVE-2026-113677
5.3 Medium
-
froxlor
Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
CVE-2026-113676
5.3 Medium
-
froxlor
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
CVE-2026-109963
5.3 Medium
-
froxlor
Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
CVE-2026-109962
5.3 Medium
-
froxlor
Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
CVE-2026-109961
8.4 High
-
froxlor
Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
CVE-2026-109960
8.7 High
-
froxlor
Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
CVE-2026-100720
9.3 Critical
-
froxlor
Froxlor before 2.3.12 Credential Disclosure via DirProtections API
CVE-2026-100719
7.1 High
-
froxlor
Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
CVE-2026-100718
7.1 High
-
froxlor
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
CVE-2026-100717
8.5 High
-
froxlor
Froxlor before 2.3.12 Privilege Escalation via Symlink
CVE-2026-100716
9.4 Critical
-
froxlor
Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
CVE-2026-100715
8.5 High
-
froxlor
Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
CVE-2026-100714
9.4 Critical
-
froxlor
Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
CVE-2026-100713
7.1 High
-
froxlor
froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
CVE-2026-100712
7.1 High
-
froxlor
froxlor before 2.3.12 Authentication Bypass via Session Persistence
CVE-2026-100711
8.7 High
-
froxlor
Froxlor before 2.3.12 DKIM Private Key Disclosure via API
CVE-2026-100710
6.9 Medium
-
froxlor
Froxlor before 2.3.11 2FA Bypass via Namespace Confusion
CVE-2026-100709
7.7 High
-
froxlor
Froxlor before 2.3.13 Private Key Disclosure via Certificates API
CVE-2026-100708
7.1 High
-
froxlor
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
CVE-2026-90937
9.4 Critical
-
froxlor
Froxlor before 2.3.12 SSH Key Injection via authorized_keys
CVE-2026-90767
7.1 High
-
froxlor
Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection
CVE-2026-55593
Fix available
6.5 Medium
-
froxlor
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
CVE-2026-54347
Fix available
8.7 High
-
froxlor
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
CVE-2026-54348
Fix available
7.2 High
-
froxlor
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
CVE-2026-54543
Fix available
5.4 Medium
-
froxlor
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
CVE-2026-62988
Fix available
9.0 Critical
-
froxlor
Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
CVE-2026-90935
Fix available
5.3 Medium
-
froxlor
Froxlor before 2.3.7 Information Disclosure via customer_email.php
CVE-2026-90936
Fix available
5.3 Medium
-
froxlor
Froxlor: API Authentication bypasses 2FA Authentication
CVE-2026-52793
Fix available
8.1 High
-
froxlor
Froxlor: BIND Zone File Injection via TXT Record Content
CVE-2026-41234
Fix available
7.6 High
-
froxlor
Froxlor has an incomplete fix for CVE-2026-30932
CVE-2026-41237
Fix available
8.6 High
-
froxlor
Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path
CVE-2026-41236
Fix available
8.8 High
-
froxlor
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
CVE-2026-41235
Fix available
8.6 High
-
froxlor
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
CVE-2026-41228
Fix available
10.0 Critical
-
froxlor
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
CVE-2026-41229
Fix available
9.1 Critical
-
froxlor
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
CVE-2026-41230
Fix available
8.5 High
-
froxlor
Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron
CVE-2026-41231
Fix available
7.5 High
-
froxlor
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing
CVE-2026-41232
Fix available
5.0 Medium
-
froxlor
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
CVE-2026-41233
Fix available
5.4 Medium
-
froxlor
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
CVE-2026-30932
Fix available
8.6 High
-
froxlor
Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
CVE-2026-26279
Fix available
9.1 Critical
-
froxlor froxlor server management panel
Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting
CVE-2020-36978
5.1 Medium
-
froxlor
Froxlor has an HTML Injection Vulnerability
CVE-2025-48958
Fix available
5.5 Medium
-
froxlor
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover
CVE-2025-29773
Fix available
5.8 Medium
-
froxlor
Froxlor before 2.2.0 Insecure File Permissions mysql.conf
CVE-2024-58383
Fix available
8.4 High
-
froxlor
Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise
CVE-2024-34070
Public exploitFix available
9.7 Critical
- Show olderLoading…