Froxlor vulnerabilities
77 CVEs and advisories name Froxlor as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54348Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
- CVE-2026-54543Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
- CVE-2026-62988Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
- CVE-2026-52793Froxlor: API Authentication bypasses 2FA Authentication
- CVE-2026-41237Froxlor has an incomplete fix for CVE-2026-30932
- CVE-2026-41236Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path
- CVE-2026-41235Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
- CVE-2026-41234Froxlor: BIND Zone File Injection via TXT Record Content
- CVE-2026-41233Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
- CVE-2026-41232Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing
- CVE-2026-41231Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron
- CVE-2026-41230Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
- CVE-2026-41229Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
- CVE-2026-41228Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2026-30932Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
- CVE-2026-26279Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
- CVE-2020-36978Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting
- CVE-2025-48958Froxlor has an HTML Injection Vulnerability
- CVE-2025-29773Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover
- CVE-2024-34070Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise
- CVE-2023-50256Froxlor username/surname AND company field Bypass
- CVE-2023-6069Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-4829Cross-site Scripting (XSS) - Stored in froxlor/froxlor
- CVE-2023-5564Cross-site Scripting (XSS) - Stored in froxlor/froxlor
- CVE-2023-4304Business Logic Errors in froxlor/froxlor
- CVE-2023-3668Improper Encoding or Escaping of Output in froxlor/froxlor
- CVE-2023-3192Session Fixation in froxlor/froxlor
- CVE-2023-3173Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2023-3172Path Traversal in froxlor/froxlor
- CVE-2023-2666Allocation of Resources Without Limits or Throttling in froxlor/froxlor