Froxlor

77 CVEs across 3 Froxlor products. Browse Froxlor vulnerabilities, severities, and proof-of-concept exploits.

Froxlor products with known CVEs

ProductCVEs
Froxlor76
Froxlor/froxlor26
Froxlor Froxlor Server Management Panel1
Froxlor CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-100720High8.72026-09-26Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificat…
CVE-2026-100719Medium6.52026-09-26Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. A…
CVE-2026-100718High7.12026-09-26Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowe…
CVE-2026-100717Critical9.92026-09-26froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the pa…
CVE-2026-100716Critical9.92026-09-26Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path componen…
CVE-2026-100715Critical9.62026-09-26Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued w…
CVE-2026-100714Critical9.12026-09-26Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no…
CVE-2026-100713High7.82026-09-26Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php…
CVE-2026-100712Medium6.52026-09-26froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g…
CVE-2026-100711High7.52026-09-26froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding h…
CVE-2026-100710Medium4.92026-09-26Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of Sub…
CVE-2026-100709High7.52026-09-26Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-to…
CVE-2026-100708High7.12026-09-26Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.g…
CVE-2026-90937Critical9.92026-09-14froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apa…
CVE-2026-90936Medium4.32026-09-14Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global s…
CVE-2026-90935Medium4.32026-09-14Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers c…
CVE-2024-58383High7.32026-09-14Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/…
CVE-2026-90767Medium6.52026-09-13Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into a…
CVE-2026-62988Critical9.02026-08-18Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and…
CVE-2026-55593Medium6.52026-08-18Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in l…
CVE-2026-54543Medium5.42026-08-18Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user…
CVE-2026-54348High7.22026-08-18Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept…
CVE-2026-54347High8.72026-08-18Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain…
CVE-2026-52793High8.12026-08-18Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAu…
CVE-2026-412372026-06-04Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded…
CVE-2026-41236High8.82026-06-04Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for…
CVE-2026-412352026-06-04Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that cu…
CVE-2026-41234High7.62026-06-04Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT r…
CVE-2026-41233Medium5.42026-04-23Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used…
CVE-2026-41232Medium5.02026-04-23Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender a…
CVE-2026-41231High7.52026-04-23Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input…
CVE-2026-41230High8.52026-04-23Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and…
CVE-2026-41229Critical9.12026-04-23Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP st…
CVE-2026-41228Critical9.92026-04-23Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not valid…
CVE-2026-30932High8.82026-03-24Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does…
CVE-2026-26279Critical9.12026-03-03Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email fo…
CVE-2020-36978Medium6.42026-01-27Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject ma…
CVE-2025-48958Medium5.52025-06-02Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacke…
CVE-2025-29773Medium5.82025-03-13Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accou…
CVE-2024-34070Critical9.62024-05-14Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Log…
CVE-2023-50256High7.52024-01-03Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such…
CVE-2023-6069Critical9.92023-11-10Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.
CVE-2023-4829Medium5.42023-10-13Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.
CVE-2023-5564Medium4.82023-10-13Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.
CVE-2023-4304Low3.82023-08-11Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
CVE-2023-3668High7.22023-07-14Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
CVE-2023-3192Medium5.42023-06-11Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
CVE-2023-3173Critical9.82023-06-09Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
CVE-2023-3172High7.22023-06-09Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
CVE-2023-2666High7.52023-05-12Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.
CVE-2023-2034High8.82023-04-14Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.
CVE-2023-1307Critical9.82023-03-10Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
CVE-2023-1033High8.82023-02-25Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.
CVE-2023-0877High8.82023-02-17Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
CVE-2023-0671High8.82023-02-04Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-0572Medium5.32023-01-29Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-0566Medium6.22023-01-29Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
CVE-2023-0565Medium5.52023-01-29Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-0564Medium5.42023-01-29Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-0316Medium5.52023-01-16Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.
CVE-2023-0315High8.82023-01-16Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.
CVE-2022-4868Medium4.32022-12-31Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
CVE-2022-4867Medium4.32022-12-31Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
CVE-2022-4864Medium5.42022-12-30Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
CVE-2022-3869Medium6.12022-11-05Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
CVE-2022-3721Medium4.62022-11-04Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.
CVE-2022-3017Medium6.52022-08-28Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.
CVE-2020-29653Medium6.12022-04-13Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the log…
CVE-2020-28957Medium5.42021-10-22Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via…
CVE-2021-42325Critical9.82021-10-12Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
CVE-2020-10237Medium5.52020-03-09An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permiss…
CVE-2020-10236Medium6.12020-03-09An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writabl…
CVE-2020-10235High8.82020-03-09An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database…
CVE-2018-1000527High7.22018-06-26Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote cod…
CVE-2018-12642High7.52018-06-22Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.
CVE-2015-5959Critical9.82017-09-06Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.
CVE-2016-5100Critical9.82017-02-13Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by…