CVE-2026-41237 | | | 2026-06-04 | Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded… |
CVE-2026-41236 | High | 8.8 | 2026-06-04 | Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for… |
CVE-2026-41235 | | | 2026-06-04 | Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that cu… |
CVE-2026-41234 | High | 7.6 | 2026-06-04 | Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT r… |
CVE-2026-41233 | Medium | 5.4 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used… |
CVE-2026-41232 | Medium | 5.0 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender a… |
CVE-2026-41231 | High | 7.5 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input… |
CVE-2026-41230 | High | 8.5 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and… |
CVE-2026-41229 | Critical | 9.1 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP st… |
CVE-2026-41228 | Critical | 9.9 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not valid… |
CVE-2026-30932 | High | 8.8 | 2026-03-24 | Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does… |
CVE-2026-26279 | Critical | 9.1 | 2026-03-03 | Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email fo… |
CVE-2020-36978 | Medium | 6.4 | 2026-01-27 | Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject ma… |
CVE-2025-48958 | Medium | 5.5 | 2025-06-02 | Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacke… |
CVE-2025-29773 | Medium | 5.8 | 2025-03-13 | Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accou… |
CVE-2024-34070 | Critical | 9.6 | 2024-05-14 | Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Log… |
CVE-2023-50256 | High | 7.5 | 2024-01-03 | Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such… |
CVE-2023-6069 | Critical | 9.9 | 2023-11-10 | Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.
|
CVE-2023-4829 | Medium | 5.4 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22. |
CVE-2023-5564 | Medium | 4.8 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1. |
CVE-2023-4304 | Low | 3.8 | 2023-08-11 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
|
CVE-2023-3668 | High | 7.2 | 2023-07-14 | Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21. |
CVE-2023-3192 | Medium | 5.4 | 2023-06-11 | Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. |
CVE-2023-3173 | Critical | 9.8 | 2023-06-09 | Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-3172 | High | 7.2 | 2023-06-09 | Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-2666 | High | 7.5 | 2023-05-12 | Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. |
CVE-2023-2034 | High | 8.8 | 2023-04-14 | Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. |
CVE-2023-1307 | Critical | 9.8 | 2023-03-10 | Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. |
CVE-2023-1033 | High | 8.8 | 2023-02-25 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2023-0877 | High | 8.8 | 2023-02-17 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2023-0671 | High | 8.8 | 2023-02-04 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-0572 | Medium | 5.3 | 2023-01-29 | Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0566 | Medium | 6.2 | 2023-01-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0565 | Medium | 5.5 | 2023-01-29 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0564 | Medium | 5.4 | 2023-01-29 | Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
|
CVE-2023-0316 | Medium | 5.5 | 2023-01-16 | Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0. |
CVE-2023-0315 | High | 8.8 | 2023-01-16 | Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. |
CVE-2022-4868 | Medium | 4.3 | 2022-12-31 | Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4867 | Medium | 4.3 | 2022-12-31 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4864 | Medium | 5.4 | 2022-12-30 | Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-3869 | Medium | 6.1 | 2022-11-05 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. |
CVE-2022-3721 | Medium | 4.6 | 2022-11-04 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. |
CVE-2022-3017 | Medium | 6.5 | 2022-08-28 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38. |
CVE-2020-29653 | Medium | 6.1 | 2022-04-13 | Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the log… |
CVE-2020-28957 | Medium | 5.4 | 2021-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2021-42325 | Critical | 9.8 | 2021-10-12 | Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. |
CVE-2020-10237 | Medium | 5.5 | 2020-03-09 | An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permiss… |
CVE-2020-10236 | Medium | 6.1 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writabl… |
CVE-2020-10235 | High | 8.8 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database… |
CVE-2018-1000527 | High | 7.2 | 2018-06-26 | Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote cod… |
CVE-2018-12642 | High | 7.5 | 2018-06-22 | Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. |
CVE-2015-5959 | Critical | 9.8 | 2017-09-06 | Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log. |
CVE-2016-5100 | Critical | 9.8 | 2017-02-13 | Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by… |