High severity · published Mar 9, 2020
CVE-2020-10235
An issue was discovered in Froxlor before 0.10.14
8.8
CVSS
1.7%
EPSS
No
On KEV
Description
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Froxlor · Froxlor
before 0.10.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10235
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10235
Exploit
https://bugzilla.suse.com/show_bug.cgi?id=1165721
Patch
https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656
Patch
https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207
Patch
https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14
More from Froxlor
9.9
CVE-2026-113678
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
9.9
CVE-2026-100717
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
9.9
CVE-2026-100716
Froxlor before 2.3.12 Privilege Escalation via Symlink
9.9
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
9.9
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution