# cve.now: Froxlor

The newest entries naming Froxlor as an affected vendor (up to 200), of 77 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121436](https://cve.now/CVE-2026-121436.md): Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api\_keys.php (CVSS 8.6)
- [CVE-2026-121435](https://cve.now/CVE-2026-121435.md): Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API (CVSS 5.3)
- [CVE-2026-121434](https://cve.now/CVE-2026-121434.md): Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API (CVSS 5.3)
- [CVE-2026-113678](https://cve.now/CVE-2026-113678.md): Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron (CVSS 9.4)
- [CVE-2026-113677](https://cve.now/CVE-2026-113677.md): Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API (CVSS 5.3)
- [CVE-2026-113676](https://cve.now/CVE-2026-113676.md): Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API (CVSS 5.3)
- [CVE-2026-109963](https://cve.now/CVE-2026-109963.md): Froxlor before 2.3.14 IDOR in Email Template Editor via admin\_templates.php (CVSS 5.3)
- [CVE-2026-109962](https://cve.now/CVE-2026-109962.md): Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API (CVSS 5.3)
- [CVE-2026-109961](https://cve.now/CVE-2026-109961.md): Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional\_members (CVSS 8.4)
- [CVE-2026-109960](https://cve.now/CVE-2026-109960.md): Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value (CVSS 8.7)
- [CVE-2026-100720](https://cve.now/CVE-2026-100720.md): Froxlor before 2.3.12 Stored XSS via SSL certificate issuer (CVSS 9.3)
- [CVE-2026-100719](https://cve.now/CVE-2026-100719.md): Froxlor before 2.3.12 Credential Disclosure via DirProtections API (CVSS 7.1)
- [CVE-2026-100718](https://cve.now/CVE-2026-100718.md): Froxlor before 2.3.12 Authentication Bypass via EmailSender.add (CVSS 7.1)
- [CVE-2026-100717](https://cve.now/CVE-2026-100717.md): froxlor before 2.3.12 CRLF Injection via validateUrl userinfo (CVSS 8.5)
- [CVE-2026-100716](https://cve.now/CVE-2026-100716.md): Froxlor before 2.3.12 Privilege Escalation via Symlink (CVSS 9.4)
- [CVE-2026-100715](https://cve.now/CVE-2026-100715.md): Froxlor before 2.3.12 Arbitrary File Deletion via Symlink (CVSS 8.5)
- [CVE-2026-100714](https://cve.now/CVE-2026-100714.md): Froxlor before 2.3.12 Command Injection via letsencryptchallengepath (CVSS 9.4)
- [CVE-2026-100713](https://cve.now/CVE-2026-100713.md): Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync (CVSS 7.1)
- [CVE-2026-100712](https://cve.now/CVE-2026-100712.md): froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF (CVSS 7.1)
- [CVE-2026-100711](https://cve.now/CVE-2026-100711.md): froxlor before 2.3.12 Authentication Bypass via Session Persistence (CVSS 8.7)
- [CVE-2026-100710](https://cve.now/CVE-2026-100710.md): Froxlor before 2.3.12 DKIM Private Key Disclosure via API (CVSS 6.9)
- [CVE-2026-100709](https://cve.now/CVE-2026-100709.md): Froxlor before 2.3.11 2FA Bypass via Namespace Confusion (CVSS 7.7)
- [CVE-2026-100708](https://cve.now/CVE-2026-100708.md): Froxlor before 2.3.13 Private Key Disclosure via Certificates API (CVSS 7.1)
- [CVE-2026-90937](https://cve.now/CVE-2026-90937.md): froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL (CVSS 9.4)
- [CVE-2026-90936](https://cve.now/CVE-2026-90936.md): Froxlor before 2.3.7 Information Disclosure via customer\_email.php (CVSS 5.3)
- [CVE-2026-90935](https://cve.now/CVE-2026-90935.md): Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API (CVSS 5.3)
- [CVE-2024-58383](https://cve.now/CVE-2024-58383.md): Froxlor before 2.2.0 Insecure File Permissions mysql.conf (CVSS 8.4)
- [CVE-2026-90767](https://cve.now/CVE-2026-90767.md): Froxlor before 2.3.12 SSH Key Injection via authorized\_keys (CVSS 7.1)
- [CVE-2026-55593](https://cve.now/CVE-2026-55593.md): Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection (CVSS 6.5)
- [CVE-2026-54347](https://cve.now/CVE-2026-54347.md): Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover (CVSS 8.7)
- [CVE-2026-54348](https://cve.now/CVE-2026-54348.md): Froxlor: Second-Order SQL Injection via \`Admins.add\` \`ipaddress\` Parameter Allows Full Database Exfiltration (CVSS 7.2)
- [CVE-2026-54543](https://cve.now/CVE-2026-54543.md): Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields (CVSS 5.4)
- [CVE-2026-62988](https://cve.now/CVE-2026-62988.md): Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints (CVSS 9.0)
- [CVE-2026-52793](https://cve.now/CVE-2026-52793.md): Froxlor: API Authentication bypasses 2FA Authentication (CVSS 8.1)
- [CVE-2026-41237](https://cve.now/CVE-2026-41237.md): Froxlor has an incomplete fix for CVE-2026-30932 (CVSS 8.6)
- [CVE-2026-41236](https://cve.now/CVE-2026-41236.md): Froxlor has privilege escalation in SSH key synchronization via symlinked \`authorized\_keys\` path (CVSS 8.8)
- [CVE-2026-41235](https://cve.now/CVE-2026-41235.md): Froxlor has an authorization bypass in FTP shell assignment via missing server-side \`available\_shells\` enforcement (CVSS 8.6)
- [CVE-2026-41234](https://cve.now/CVE-2026-41234.md): Froxlor: BIND Zone File Injection via TXT Record Content (CVSS 7.6)
- [CVE-2026-41233](https://cve.now/CVE-2026-41233.md): Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() (CVSS 5.4)
- [CVE-2026-41232](https://cve.now/CVE-2026-41232.md): Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing (CVSS 5.0)
- [CVE-2026-41231](https://cve.now/CVE-2026-41231.md): Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron (CVSS 7.5)
- [CVE-2026-41230](https://cve.now/CVE-2026-41230.md): Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() (CVSS 8.5)
- [CVE-2026-41229](https://cve.now/CVE-2026-41229.md): Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) (CVSS 9.1)
- [CVE-2026-41228](https://cve.now/CVE-2026-41228.md): Froxlor has Local File Inclusion via path traversal in API \`def\_language\` parameter that leads to Remote Code Execution (CVSS 10.0)
- [CVE-2026-30932](https://cve.now/CVE-2026-30932.md): Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API (CVSS 8.6)
- [CVE-2026-26279](https://cve.now/CVE-2026-26279.md): Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection (CVSS 9.1)
- [CVE-2020-36978](https://cve.now/CVE-2020-36978.md): Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting (CVSS 5.1)
- [CVE-2025-48958](https://cve.now/CVE-2025-48958.md): Froxlor has an HTML Injection Vulnerability (CVSS 5.5)
- [CVE-2025-29773](https://cve.now/CVE-2025-29773.md): Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover (CVSS 5.8)
- [CVE-2024-34070](https://cve.now/CVE-2024-34070.md): Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise (CVSS 9.7)
- [CVE-2023-50256](https://cve.now/CVE-2023-50256.md): Froxlor username/surname AND company field Bypass (CVSS 7.5)
- [CVE-2023-6069](https://cve.now/CVE-2023-6069.md): Improper Link Resolution Before File Access in froxlor/froxlor (CVSS 9.9)
- [CVE-2023-4829](https://cve.now/CVE-2023-4829.md): Cross-site Scripting (XSS) - Stored in froxlor/froxlor (CVSS 4.3)
- [CVE-2023-5564](https://cve.now/CVE-2023-5564.md): Cross-site Scripting (XSS) - Stored in froxlor/froxlor (CVSS 5.2)
- [CVE-2023-4304](https://cve.now/CVE-2023-4304.md): Business Logic Errors in froxlor/froxlor (CVSS 3.8)
- [CVE-2023-3668](https://cve.now/CVE-2023-3668.md): Improper Encoding or Escaping of Output in froxlor/froxlor (CVSS 9.1)
- [CVE-2023-3192](https://cve.now/CVE-2023-3192.md): Session Fixation in froxlor/froxlor (CVSS 4.2)
- [CVE-2023-3173](https://cve.now/CVE-2023-3173.md): Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor (CVSS 9.8)
- [CVE-2023-3172](https://cve.now/CVE-2023-3172.md): Path Traversal in froxlor/froxlor (CVSS 6.5)
- [CVE-2023-2666](https://cve.now/CVE-2023-2666.md): Allocation of Resources Without Limits or Throttling in froxlor/froxlor (CVSS 6.8)
- [CVE-2023-2034](https://cve.now/CVE-2023-2034.md): Unrestricted Upload of File with Dangerous Type in froxlor/froxlor (CVSS 9.1)
- [CVE-2023-1307](https://cve.now/CVE-2023-1307.md): Authentication Bypass by Primary Weakness in froxlor/froxlor (CVSS 9.8)
- [CVE-2023-1033](https://cve.now/CVE-2023-1033.md): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (CVSS 6.8)
- [CVE-2023-0877](https://cve.now/CVE-2023-0877.md): Code Injection in froxlor/froxlor (CVSS 9.1)
- [CVE-2023-0671](https://cve.now/CVE-2023-0671.md): Code Injection in froxlor/froxlor (CVSS 9.9)
- [CVE-2023-0572](https://cve.now/CVE-2023-0572.md): Unchecked Error Condition in froxlor/froxlor (CVSS 5.3)
- [CVE-2023-0566](https://cve.now/CVE-2023-0566.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor (CVSS 6.2)
- [CVE-2023-0565](https://cve.now/CVE-2023-0565.md): Business Logic Errors in froxlor/froxlor (CVSS 5.5)
- [CVE-2023-0564](https://cve.now/CVE-2023-0564.md): Weak Password Requirements in froxlor/froxlor (CVSS 5.4)
- [CVE-2023-0316](https://cve.now/CVE-2023-0316.md): Path Traversal: '\\..\\filename' in froxlor/froxlor (CVSS 6.8)
- [CVE-2023-0315](https://cve.now/CVE-2023-0315.md): Command Injection in froxlor/froxlor (CVSS 7.2)
- [CVE-2022-4868](https://cve.now/CVE-2022-4868.md): Improper Authorization in froxlor/froxlor (CVSS 6.5)
- [CVE-2022-4867](https://cve.now/CVE-2022-4867.md): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (CVSS 3.5)
- [CVE-2022-4864](https://cve.now/CVE-2022-4864.md): Argument Injection in froxlor/froxlor (CVSS 5.3)
- [CVE-2022-3869](https://cve.now/CVE-2022-3869.md): Code Injection in froxlor/froxlor (CVSS 6.5)
- [CVE-2022-3721](https://cve.now/CVE-2022-3721.md): Code Injection in froxlor/froxlor (CVSS 7.6)
- [CVE-2022-3017](https://cve.now/CVE-2022-3017.md): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/froxlor
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.