Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8

An issue was discovered in Froxlor before 0.10.14

Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor has an incomplete fix for CVE-2026-30932

Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

Froxlor: API Authentication bypasses 2FA Authentication

Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

Froxlor: BIND Zone File Injection via TXT Record Content

froxlor before 2.3.12 Authentication Bypass via Session Persistence

Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron

Froxlor is open source server administration software

Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16

Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user

Froxlor before 2.2.0 Insecure File Permissions mysql.conf

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20

Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution

Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

Froxlor before 2.3.13 Private Key Disclosure via Certificates API