High severity · published Mar 13, 2025
CVE-2025-29773
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin. The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues. Version 2.2.6 fixes the issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Froxlor · froxlor
< 2.2.6 · source: vendor, NVD
Affected product
FR
Froxlor
froxlor
More from Froxlor
9.9
CVE-2026-113678
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
9.9
CVE-2026-100717
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
9.9
CVE-2026-100716
Froxlor before 2.3.12 Privilege Escalation via Symlink
9.9
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
9.9
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution