Froxlor before 2.3.12 Credential Disclosure via DirProtections API

froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38

Code Injection in froxlor/froxlor

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter

An issue was discovered in Froxlor before 0.10.14

Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0

An issue was discovered in Froxlor through 0.10.15

Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

Froxlor has an HTML Injection Vulnerability

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22

Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0

Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1

Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…

Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10

Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing

Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10

Code Injection in froxlor/froxlor

Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API

Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0