FFroxlor

Products

Exploited and recent CVEs

• CVE-2026-121436 High 7.2 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php 0.4%
• CVE-2026-121435 Medium 4.3 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API 0.2%
• CVE-2026-121434 Medium 5.4 Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API 0.2%
• CVE-2026-113678 Critical 9.9 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron 0.6%
• CVE-2026-113677 Medium 5.4 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API 0.4%
• CVE-2026-113676 Medium 4.3 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API 0.4%
• CVE-2026-109963 Medium 4.3 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php 0.3%
• CVE-2026-109962 Medium 4.3 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API 0.3%
• CVE-2026-109961 High 8.5 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members 0.2%
• CVE-2026-109960 High 7.7 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value 0.3%
• CVE-2026-100720 High 8.7 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer 0.2%
• CVE-2026-100719 Medium 6.5 Froxlor before 2.3.12 Credential Disclosure via DirProtections API 0.2%
• CVE-2026-100718 High 7.1 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add 0.2%
• CVE-2026-100717 Critical 9.9 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo 0.3%
• CVE-2026-100716 Critical 9.9 Froxlor before 2.3.12 Privilege Escalation via Symlink 0.5%
• CVE-2026-100715 Critical 9.6 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink 0.5%
• CVE-2026-100714 Critical 9.1 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath 0.5%
• CVE-2026-100713 High 7.8 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync 0.2%
• CVE-2026-100712 Medium 6.5 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF 0.1%
• CVE-2026-100711 High 7.5 froxlor before 2.3.12 Authentication Bypass via Session Persistence 0.3%
• CVE-2026-100710 Medium 4.9 Froxlor before 2.3.12 DKIM Private Key Disclosure via API 0.2%
• CVE-2026-100709 High 7.5 Froxlor before 2.3.11 2FA Bypass via Namespace Confusion 0.3%
• CVE-2026-100708 High 7.1 Froxlor before 2.3.13 Private Key Disclosure via Certificates API 0.2%
• CVE-2026-90937 Critical 9.9 froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL 0.5%
• CVE-2026-90936 Medium 4.3 Froxlor before 2.3.7 Information Disclosure via customer_email.php 0.3%
• CVE-2026-90935 Medium 4.3 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API 0.3%
• CVE-2024-58383 High 7.3 Froxlor before 2.2.0 Insecure File Permissions mysql.conf 0.2%
• CVE-2026-90767 Medium 6.5 Froxlor before 2.3.12 SSH Key Injection via authorized_keys 0.4%
• CVE-2026-55593 Medium 6.5 Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection 0.3%
• CVE-2026-54347 High 8.7 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover 0.4%