Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

Froxlor before 2.3.12 Privilege Escalation via Symlink

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value

Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints