Read the docs

froxlor

Records87All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high38CVSS 7.0–8.9

Exploited now

froxlor records in CISA KEV

No froxlor vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Froxlor 47 records CRITICAL

Records

87 records

TI-2023-00300 CVE-2023-0315 · GHSA-cp68-42pf-6627

Command Injection in froxlor/froxlor

Priority CRITICAL 85

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.97653 Published 2023-01-16 Fixed in 2.0.8 CWE-77
TI-2026-76945 CVE-2026-113678 · GHSA-j3hm-8rm8-m243

Symlink following in Froxlor enables root privilege escalation

Priority HIGH 76

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cr…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00632 Published 2026-10-20 Fixed in 2.3.15 CWE-59
TI-2026-71727 CVE-2026-109960 · GHSA-wj7h-phvf-62w3

Stored cross-site scripting in Froxlor via customer theme value

Priority HIGH 73

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php.

CVSS 4.0HIGH 8.7 Network Low privileges User interaction EPSS 0.00292 Published 2026-10-13 Fixed in 2.3.14 CWE-79
TI-2023-00832 CVE-2023-0877 · GHSA-vp4r-h765-5mwp

Code Injection in froxlor/froxlor

Priority HIGH 73

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03928 Published 2023-02-17 Fixed in 2.0.11 CWE-94
TI-2023-00636 CVE-2023-0671 · GHSA-9fqc-9cpr-w73q

Code Injection in froxlor/froxlor

Priority HIGH 73

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01119 Published 2023-02-04 Fixed in 2.0.10 CWE-94
TI-2026-64871 CVE-2026-100715 · GHSA-x2f4-5vf2-hf4j

Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Priority HIGH 72

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00458 Published 2026-09-26 Fixed in 2.3.12 CWE-59
TI-2024-38462 CVE-2024-58383 · GHSA-x2wh-r8m8-h3h3

Froxlor before 2.2.0 Insecure File Permissions mysql.conf

Priority HIGH 72

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL u…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00155 Published 2026-09-14 Fixed in 2.2.0 CWE-732
TI-2023-00978 CVE-2023-1033 · GHSA-p7qq-rrvw-x55x

Cross-Site Request Forgery (CSRF) in froxlor/froxlor

Priority HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00324 Published 2023-02-25 Fixed in 2.0.11 CWE-352
TI-2026-71728 CVE-2026-109961 · GHSA-5986-h43p-hp85

Newline injection in Froxlor enables local privilege escalation

Priority HIGH 70

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parame…

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-13 Fixed in 2.3.14 CWE-74
TI-2025-21185 CVE-2025-29773 · GHSA-7j6w-p859-464f

Improper authentication in Froxlor

Priority HIGH 69

Froxlor is open-source server administration software.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00289 Published 2025-03-13 Fixed in 2.2.6 CWE-287
Load more
Open these records in search →