FR
Vendor
froxlor
85
CVEs
0
On KEV
7
New 30D
Products
FR9.9
froxlor
froxlor
82 CVEs0 on KEV7 new
FR6.1
froxlor/froxlor
froxlor
2 CVEs0 on KEV0 new
FF6.4
Froxlor Froxlor Server Management Panel
Froxlor
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113678 | FR froxlor froxlor | 9.9 | Oct 20 | Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron |
| CVE-2026-113677 | FR froxlor froxlor | 5.4 | Oct 20 | Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API |
| CVE-2026-113676 | FR froxlor froxlor | 4.3 | Oct 20 | Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API |
| CVE-2026-109963 | FR froxlor froxlor | 4.3 | Oct 13 | Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php |
| CVE-2026-109962 | FR froxlor froxlor | 4.3 | Oct 13 | Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API |
| CVE-2026-109961 | FR froxlor froxlor | 8.5 | Oct 13 | Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members |
| CVE-2026-109960 | FR froxlor froxlor | 7.7 | Oct 13 | Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value |
| CVE-2026-100720 | FR froxlor froxlor | 8.7 | Sep 26 | Froxlor before 2.3.12 Stored XSS via SSL certificate issuer |
| CVE-2026-100719 | FR froxlor froxlor | 6.5 | Sep 26 | Froxlor before 2.3.12 Credential Disclosure via DirProtections API |
| CVE-2026-100718 | FR froxlor froxlor | 7.1 | Sep 26 | Froxlor before 2.3.12 Authentication Bypass via EmailSender.add |
| CVE-2026-100717 | FR froxlor froxlor | 9.9 | Sep 26 | froxlor before 2.3.12 CRLF Injection via validateUrl userinfo |
| CVE-2026-100716 | FR froxlor froxlor | 9.9 | Sep 26 | Froxlor before 2.3.12 Privilege Escalation via Symlink |
| CVE-2026-100715 | FR froxlor froxlor | 9.6 | Sep 26 | Froxlor before 2.3.12 Arbitrary File Deletion via Symlink |
| CVE-2026-100714 | FR froxlor froxlor | 9.1 | Sep 26 | Froxlor before 2.3.12 Command Injection via letsencryptchallengepath |
| CVE-2026-100713 | FR froxlor froxlor | 7.8 | Sep 26 | Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync |
| CVE-2026-100712 | FR froxlor froxlor | 6.5 | Sep 26 | froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF |
| CVE-2026-100711 | FR froxlor froxlor | 7.5 | Sep 26 | froxlor before 2.3.12 Authentication Bypass via Session Persistence |
| CVE-2026-100710 | FR froxlor froxlor | 4.9 | Sep 26 | Froxlor before 2.3.12 DKIM Private Key Disclosure via API |
| CVE-2026-100709 | FR froxlor froxlor | 7.5 | Sep 26 | Froxlor before 2.3.12 2FA Bypass via Namespace Confusion |
| CVE-2026-100708 | FR froxlor froxlor | 7.1 | Sep 26 | Froxlor before 2.3.13 Private Key Disclosure via Certificates API |
| CVE-2026-90937 | FR froxlor froxlor | 9.9 | Sep 14 | froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL |
| CVE-2026-90936 | FR froxlor froxlor | 4.3 | Sep 14 | Froxlor before 2.3.7 Information Disclosure via customer_email.php |
| CVE-2026-90935 | FR froxlor froxlor | 4.3 | Sep 14 | Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API |
| CVE-2024-58383 | FR froxlor froxlor | 7.3 | Sep 14 | Froxlor before 2.2.0 Insecure File Permissions mysql.conf |
| CVE-2026-90767 | FR Froxlor froxlor | 6.5 | Sep 13 | Froxlor before 2.3.12 SSH Key Injection via authorized_keys |
| CVE-2026-55593 | FR froxlor froxlor | 6.5 | Aug 18 | Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection |
| CVE-2026-54347 | FR froxlor froxlor | 8.7 | Aug 18 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover |
| CVE-2026-54348 | FR froxlor froxlor | 7.2 | Aug 18 | Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration |
| CVE-2026-54543 | FR froxlor froxlor | 5.4 | Aug 18 | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields |
| CVE-2026-62988 | FR froxlor froxlor | 9.0 | Aug 18 | Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints |
| CVE-2026-52793 | FR froxlor froxlor | 8.1 | Aug 18 | Froxlor: API Authentication bypasses 2FA Authentication |
| CVE-2026-41237 | FR froxlor froxlor | 8.6 | Jun 4 | Froxlor has an incomplete fix for CVE-2026-30932 |
| CVE-2026-41236 | FR froxlor froxlor | 8.8 | Jun 4 | Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path |
| CVE-2026-41235 | FR froxlor froxlor | 8.6 | Jun 4 | Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement |
| CVE-2026-41234 | FR froxlor froxlor | 7.6 | Jun 4 | Froxlor: BIND Zone File Injection via TXT Record Content |
| CVE-2026-41233 | FR froxlor froxlor | 5.4 | Apr 23 | Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() |
| CVE-2026-41232 | FR froxlor froxlor | 5.0 | Apr 23 | Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing |
| CVE-2026-41231 | FR froxlor froxlor | 7.5 | Apr 23 | Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron |
| CVE-2026-41230 | FR froxlor froxlor | 8.5 | Apr 23 | Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() |
| CVE-2026-41229 | FR froxlor froxlor | 9.1 | Apr 23 | Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) |
| CVE-2026-41228 | FR froxlor froxlor | 9.9 | Apr 23 | Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution |
| CVE-2026-30932 | FR froxlor froxlor | 8.8 | Mar 24 | Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API |
| CVE-2026-26279 | FR Froxlor froxlor | 9.1 | Mar 3 | Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection |
| CVE-2020-36978 | FF Froxlor Froxlor Server Management Panel Froxlor | 6.4 | Jan 27 | Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting |
| CVE-2025-48958 | FR Froxlor froxlor | 5.4 | Jun 2 | Froxlor has an HTML Injection Vulnerability |
| CVE-2025-29773 | FR Froxlor froxlor | 7.8 | Mar 13 | Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover |
| CVE-2023-50256 | FR Froxlor Froxlor | 7.5 | Jan 3 | Froxlor is open source server administration software |
| CVE-2023-6069 | FR Froxlor Froxlor | 8.8 | Nov 10 | Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0 |
| CVE-2023-4829 | FR Froxlor Froxlor | 5.4 | Oct 13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22 |
| CVE-2023-5564 | FR Froxlor Froxlor | 4.8 | Oct 13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1 |
| CVE-2023-4304 | FR Froxlor Froxlor | 2.7 | Aug 11 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0 |
| CVE-2023-3668 | FR Froxlor Froxlor | 7.2 | Jul 14 | Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21 |
| CVE-2023-3192 | FR Froxlor Froxlor | 5.4 | Jun 11 | Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0 |
| CVE-2023-3173 | FR Froxlor Froxlor | 9.8 | Jun 9 | Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20 |
| CVE-2023-3172 | FR Froxlor Froxlor | 7.2 | Jun 9 | Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20 |
| CVE-2023-2666 | FR Froxlor Froxlor | 7.5 | May 12 | Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16 |
| CVE-2023-2034 | FR Froxlor Froxlor | 8.8 | Apr 14 | Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14 |
| CVE-2023-1307 | FR Froxlor Froxlor | 9.8 | Mar 10 | Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13 |
| CVE-2023-1033 | FR Froxlor Froxlor | 8.8 | Feb 25 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11 |
| CVE-2023-0877 | FR Froxlor Froxlor | 8.8 | Feb 17 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11 |