Froxlor Froxlor

• CVE-2026-121436 High 7.2 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php 0.4%
• CVE-2026-121435 Medium 4.3 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API 0.2%
• CVE-2026-121434 Medium 5.4 Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API 0.2%
• CVE-2026-113678 Critical 9.9 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron 0.6%
• CVE-2026-113677 Medium 5.4 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API 0.4%
• CVE-2026-113676 Medium 4.3 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API 0.4%
• CVE-2026-109963 Medium 4.3 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php 0.3%
• CVE-2026-109962 Medium 4.3 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API 0.3%
• CVE-2026-109961 High 8.5 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members 0.2%
• CVE-2026-109960 High 7.7 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value 0.3%
• CVE-2026-100720 High 8.7 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer 0.2%
• CVE-2026-100719 Medium 6.5 Froxlor before 2.3.12 Credential Disclosure via DirProtections API 0.2%
• CVE-2026-100718 High 7.1 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add 0.2%
• CVE-2026-100717 Critical 9.9 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo 0.3%
• CVE-2026-100716 Critical 9.9 Froxlor before 2.3.12 Privilege Escalation via Symlink 0.5%
• CVE-2026-100715 Critical 9.6 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink 0.5%
• CVE-2026-100714 Critical 9.1 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath 0.5%
• CVE-2026-100713 High 7.8 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync 0.2%
• CVE-2026-100712 Medium 6.5 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF 0.1%
• CVE-2026-100711 High 7.5 froxlor before 2.3.12 Authentication Bypass via Session Persistence 0.3%
• CVE-2026-100710 Medium 4.9 Froxlor before 2.3.12 DKIM Private Key Disclosure via API 0.2%
• CVE-2026-100709 High 7.5 Froxlor before 2.3.11 2FA Bypass via Namespace Confusion 0.3%
• CVE-2026-100708 High 7.1 Froxlor before 2.3.13 Private Key Disclosure via Certificates API 0.2%
• CVE-2026-90937 Critical 9.9 froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL 0.5%
• CVE-2026-90936 Medium 4.3 Froxlor before 2.3.7 Information Disclosure via customer_email.php 0.3%
• CVE-2026-90935 Medium 4.3 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API 0.3%
• CVE-2024-58383 High 7.3 Froxlor before 2.2.0 Insecure File Permissions mysql.conf 0.2%
• CVE-2026-90767 Medium 6.5 Froxlor before 2.3.12 SSH Key Injection via authorized_keys 0.4%
• CVE-2026-55593 Medium 6.5 Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection 0.3%
• CVE-2026-54347 High 8.7 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover 0.4%
• CVE-2026-54348 High 7.2 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration 0.7%
• CVE-2026-54543 Medium 5.4 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields 0.4%
• CVE-2026-62988 Critical 9.0 Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints 0.6%
• CVE-2026-52793 High 8.1 Froxlor: API Authentication bypasses 2FA Authentication 0.3%
• CVE-2026-41237 High 8.6 Froxlor has an incomplete fix for CVE-2026-30932 0.3%
• CVE-2026-41236 High 8.8 Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path 0.4%
• CVE-2026-41235 High 8.6 Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement 0.2%
• CVE-2026-41234 High 7.6 Froxlor: BIND Zone File Injection via TXT Record Content 0.3%
• CVE-2026-41233 Medium 5.4 Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() 0.3%
• CVE-2026-41232 Medium 5.0 Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing 0.2%
• CVE-2026-41231 High 7.5 Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron 0.4%
• CVE-2026-41230 High 8.5 Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() 0.3%
• CVE-2026-41229 Critical 9.1 Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) 0.5%
• CVE-2026-41228 Critical 10.0 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution 0.5%
• CVE-2026-30932 High 8.6 Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API 0.6%
• CVE-2026-26279 Critical 9.1 Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection 0.9%
• CVE-2025-48958 Medium 5.5 Froxlor has an HTML Injection Vulnerability 0.4%
• CVE-2025-29773 Medium 5.8 Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover 0.3%
• CVE-2024-34070 Critical 9.7 Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise 1.0%
• CVE-2023-50256 High 7.5 Froxlor username/surname AND company field Bypass 0.7%