Froxlor vulnerabilities
77 CVEs and advisories name Froxlor as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121436Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
- CVE-2026-121435Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
- CVE-2026-121434Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API
- CVE-2026-113678Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
- CVE-2026-113677Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
- CVE-2026-113676Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
- CVE-2026-109963Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
- CVE-2026-109962Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
- CVE-2026-109961Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
- CVE-2026-109960Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
- CVE-2026-100720Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
- CVE-2026-100719Froxlor before 2.3.12 Credential Disclosure via DirProtections API
- CVE-2026-100718Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
- CVE-2026-100717froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
- CVE-2026-100716Froxlor before 2.3.12 Privilege Escalation via Symlink
- CVE-2026-100715Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
- CVE-2026-100714Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
- CVE-2026-100713Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
- CVE-2026-100712froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
- CVE-2026-100711froxlor before 2.3.12 Authentication Bypass via Session Persistence
- CVE-2026-100710Froxlor before 2.3.12 DKIM Private Key Disclosure via API
- CVE-2026-100709Froxlor before 2.3.11 2FA Bypass via Namespace Confusion
- CVE-2026-100708Froxlor before 2.3.13 Private Key Disclosure via Certificates API
- CVE-2026-90937froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
- CVE-2026-90936Froxlor before 2.3.7 Information Disclosure via customer_email.php
- CVE-2026-90935Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
- CVE-2024-58383Froxlor before 2.2.0 Insecure File Permissions mysql.conf
- CVE-2026-90767Froxlor before 2.3.12 SSH Key Injection via authorized_keys
- CVE-2026-55593Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection
- CVE-2026-54347Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover