CVE-2026-100720 | High | 8.7 | 2026-09-26 | Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificat… |
CVE-2026-100719 | Medium | 6.5 | 2026-09-26 | Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. A… |
CVE-2026-100718 | High | 7.1 | 2026-09-26 | Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowe… |
CVE-2026-100717 | Critical | 9.9 | 2026-09-26 | froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the pa… |
CVE-2026-100716 | Critical | 9.9 | 2026-09-26 | Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path componen… |
CVE-2026-100715 | Critical | 9.6 | 2026-09-26 | Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued w… |
CVE-2026-100714 | Critical | 9.1 | 2026-09-26 | Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no… |
CVE-2026-100713 | High | 7.8 | 2026-09-26 | Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php… |
CVE-2026-100712 | Medium | 6.5 | 2026-09-26 | froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g… |
CVE-2026-100711 | High | 7.5 | 2026-09-26 | froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding h… |
CVE-2026-100710 | Medium | 4.9 | 2026-09-26 | Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of Sub… |
CVE-2026-100709 | High | 7.5 | 2026-09-26 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-to… |
CVE-2026-100708 | High | 7.1 | 2026-09-26 | Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.g… |
CVE-2026-90937 | Critical | 9.9 | 2026-09-14 | froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apa… |
CVE-2026-90936 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global s… |
CVE-2026-90935 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers c… |
CVE-2024-58383 | High | 7.3 | 2026-09-14 | Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/… |
CVE-2026-90767 | Medium | 6.5 | 2026-09-13 | Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into a… |
CVE-2026-62988 | Critical | 9.0 | 2026-08-18 | Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and… |
CVE-2026-55593 | Medium | 6.5 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in l… |
CVE-2026-54543 | Medium | 5.4 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user… |
CVE-2026-54348 | High | 7.2 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept… |
CVE-2026-54347 | High | 8.7 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain… |
CVE-2026-52793 | High | 8.1 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAu… |
CVE-2026-41237 | | | 2026-06-04 | Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded… |
CVE-2026-41236 | High | 8.8 | 2026-06-04 | Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for… |
CVE-2026-41235 | | | 2026-06-04 | Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that cu… |
CVE-2026-41234 | High | 7.6 | 2026-06-04 | Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT r… |
CVE-2026-41233 | Medium | 5.4 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used… |
CVE-2026-41232 | Medium | 5.0 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender a… |
CVE-2026-41231 | High | 7.5 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input… |
CVE-2026-41230 | High | 8.5 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and… |
CVE-2026-41229 | Critical | 9.1 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP st… |
CVE-2026-41228 | Critical | 9.9 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not valid… |
CVE-2026-30932 | High | 8.8 | 2026-03-24 | Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does… |
CVE-2026-26279 | Critical | 9.1 | 2026-03-03 | Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email fo… |
CVE-2020-36978 | Medium | 6.4 | 2026-01-27 | Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject ma… |
CVE-2025-48958 | Medium | 5.5 | 2025-06-02 | Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacke… |
CVE-2025-29773 | Medium | 5.8 | 2025-03-13 | Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accou… |
CVE-2024-34070 | Critical | 9.6 | 2024-05-14 | Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Log… |
CVE-2023-50256 | High | 7.5 | 2024-01-03 | Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such… |
CVE-2023-6069 | Critical | 9.9 | 2023-11-10 | Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.
|
CVE-2023-4829 | Medium | 5.4 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22. |
CVE-2023-5564 | Medium | 4.8 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1. |
CVE-2023-4304 | Low | 3.8 | 2023-08-11 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
|
CVE-2023-3668 | High | 7.2 | 2023-07-14 | Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21. |
CVE-2023-3192 | Medium | 5.4 | 2023-06-11 | Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. |
CVE-2023-3173 | Critical | 9.8 | 2023-06-09 | Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-3172 | High | 7.2 | 2023-06-09 | Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-2666 | High | 7.5 | 2023-05-12 | Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. |
CVE-2023-2034 | High | 8.8 | 2023-04-14 | Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. |
CVE-2023-1307 | Critical | 9.8 | 2023-03-10 | Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. |
CVE-2023-1033 | High | 8.8 | 2023-02-25 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2023-0877 | High | 8.8 | 2023-02-17 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2023-0671 | High | 8.8 | 2023-02-04 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-0572 | Medium | 5.3 | 2023-01-29 | Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0566 | Medium | 6.2 | 2023-01-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0565 | Medium | 5.5 | 2023-01-29 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0564 | Medium | 5.4 | 2023-01-29 | Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0316 | Medium | 5.5 | 2023-01-16 | Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0. |
CVE-2023-0315 | High | 8.8 | 2023-01-16 | Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. |
CVE-2022-4868 | Medium | 4.3 | 2022-12-31 | Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4867 | Medium | 4.3 | 2022-12-31 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4864 | Medium | 5.4 | 2022-12-30 | Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-3869 | Medium | 6.1 | 2022-11-05 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. |
CVE-2022-3721 | Medium | 4.6 | 2022-11-04 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. |
CVE-2022-3017 | Medium | 6.5 | 2022-08-28 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38. |
CVE-2020-29653 | Medium | 6.1 | 2022-04-13 | Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the log… |
CVE-2020-28957 | Medium | 5.4 | 2021-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2021-42325 | Critical | 9.8 | 2021-10-12 | Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. |
CVE-2020-10237 | Medium | 5.5 | 2020-03-09 | An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permiss… |
CVE-2020-10236 | Medium | 6.1 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writabl… |
CVE-2020-10235 | High | 8.8 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database… |
CVE-2018-1000527 | High | 7.2 | 2018-06-26 | Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote cod… |
CVE-2018-12642 | High | 7.5 | 2018-06-22 | Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. |
CVE-2015-5959 | Critical | 9.8 | 2017-09-06 | Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log. |
CVE-2016-5100 | Critical | 9.8 | 2017-02-13 | Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by… |