Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

Froxlor before 2.3.12 Privilege Escalation via Symlink

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value

Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8

An issue was discovered in Froxlor before 0.10.14

Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor has an incomplete fix for CVE-2026-30932

Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

Froxlor: API Authentication bypasses 2FA Authentication

Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

Froxlor: BIND Zone File Injection via TXT Record Content

froxlor before 2.3.12 Authentication Bypass via Session Persistence

Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron

Froxlor is open source server administration software

Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16

Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user

Froxlor before 2.2.0 Insecure File Permissions mysql.conf

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20

Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution

Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Froxlor before 2.3.12 Credential Disclosure via DirProtections API