froxlor

Records87All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical16CVSS 9.0–10.0

CVSS high38CVSS 7.0–8.9

Exploited now

froxlor records in CISA KEV

No froxlor vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Froxlor 47 records CRITICAL

Records

47 records in Froxlor · all components

TI-2023-00300 CVE-2023-0315 · GHSA-cp68-42pf-6627

Command Injection in froxlor/froxlor

CRITICAL 85

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.97653 Published 2023-01-16 Fixed in 2.0.8 CWE-77

TI-2023-02973 CVE-2023-3173 · GHSA-chw4-88xc-79w6

Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor

HIGH 82

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01119 Published 2023-06-09 Fixed in 2.0.20 CWE-307

TI-2023-01234 CVE-2023-1307 · GHSA-j83x-r9qq-9g4v

Authentication Bypass by Primary Weakness in froxlor/froxlor

HIGH 82

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01073 Published 2023-03-10 Fixed in 2.0.13 CWE-305

TI-2023-01911 CVE-2023-2034 · GHSA-qwvp-g9j7-28f6

Unrestricted Upload of File with Dangerous Type in froxlor/froxlor

HIGH 78

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.7143 Published 2023-04-14 Fixed in 2.0.14 CWE-434

TI-2026-29837 CVE-2026-41228 · GHSA-w59f-67xm-rxx7

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

HIGH 76

Froxlor is open source server administration software.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00524 Published 2026-04-23 Fixed in 2.3.6 CWE-98

TI-2026-29838 CVE-2026-41229 · GHSA-gc9w-cc93-rjv8

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

HIGH 74

Froxlor is open source server administration software.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0048 Published 2026-04-23 Fixed in 2.3.6 CWE-94

TI-2023-00832 CVE-2023-0877 · GHSA-vp4r-h765-5mwp

Code Injection in froxlor/froxlor

HIGH 73

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03928 Published 2023-02-17 Fixed in 2.0.11 CWE-94

TI-2023-00636 CVE-2023-0671 · GHSA-9fqc-9cpr-w73q

Code Injection in froxlor/froxlor

HIGH 73

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01119 Published 2023-02-04 Fixed in 2.0.10 CWE-94

TI-2023-00978 CVE-2023-1033 · GHSA-p7qq-rrvw-x55x

Cross-Site Request Forgery (CSRF) in froxlor/froxlor

HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00324 Published 2023-02-25 Fixed in 2.0.11 CWE-352

TI-2026-29839 CVE-2026-41230 · GHSA-47hf-23pw-3m8c

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

HIGH 70

Froxlor is open source server administration software.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00347 Published 2026-04-23 Fixed in 2.3.6 CWE-93

TI-2026-23757 CVE-2026-30932 · GHSA-x6w6-2xwp-3jh6

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

HIGH 70

Froxlor is open source server administration software.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00565 Published 2026-03-24 Fixed in 2.3.5 CWE-74

TI-2025-21185 CVE-2025-29773 · GHSA-7j6w-p859-464f

Improper authentication in Froxlor

HIGH 69

Froxlor is open-source server administration software.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00289 Published 2025-03-13 Fixed in 2.2.6 CWE-287

TI-2026-29840 CVE-2026-41231 · GHSA-75h4-c557-j89r

Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron

HIGH 68

Froxlor is open source server administration software.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00414 Published 2026-04-23 Fixed in 2.3.6 CWE-59

TI-2023-02494 CVE-2023-2666 · GHSA-4gm9-c9jq-g523

Allocation of Resources Without Limits or Throttling in froxlor/froxlor

HIGH 68

Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00681 Published 2023-05-12 Fixed in 2.0.16 CWE-770

TI-2023-03425 CVE-2023-3668 · GHSA-c6v5-pf66-xfq8

Improper Encoding or Escaping of Output in froxlor/froxlor

HIGH 67

Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01008 Published 2023-07-14 Fixed in 2.0.21 CWE-116

TI-2023-00535 CVE-2023-0564 · GHSA-pm72-27mg-fc28

Weak Password Requirements in froxlor/froxlor

HIGH 66

Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00455 Published 2023-01-29 Fixed in 2.0.10 CWE-521

TI-2023-02972 CVE-2023-3172 · GHSA-ghqq-jfx7-f6m9

Path Traversal in froxlor/froxlor

HIGH 65

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01206 Published 2023-06-09 Fixed in 2.0.20 CWE-22

TI-2023-00543 CVE-2023-0572 · GHSA-3chw-8jq2-w769

Unchecked Error Condition in froxlor/froxlor

MEDIUM 63

Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00667 Published 2023-01-29 Fixed in 2.0.10 CWE-391

TI-2023-00537 CVE-2023-0566 · GHSA-w7w4-qjgg-372x

Cross-site scripting in froxlor/froxlor

MEDIUM 63

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.00439 Published 2023-01-29 Fixed in 2.0.10 CWE-79

TI-2022-03547 CVE-2022-3869 · GHSA-6rjv-xxgr-v57x

Code Injection in froxlor/froxlor

MEDIUM 62

Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01832 Published 2022-11-05 Fixed in 0.10.38.2 CWE-94

TI-2026-29842 CVE-2026-41233 · GHSA-jvx4-xv3m-hrj4

Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

MEDIUM 58

Froxlor is open source server administration software.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00264 Published 2026-04-23 Fixed in 2.3.6 CWE-863

TI-2025-31096 CVE-2025-48958 · GHSA-26xq-m8xw-6373

Froxlor has an HTML Injection Vulnerability

MEDIUM 58

Froxlor is open source server administration software.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.0035 Published 2025-06-02 Fixed in 2.2.6 CWE-79

TI-2023-04445 CVE-2023-4829 · GHSA-cvwv-h85m-w37h

Cross-site Scripting (XSS) - Stored in froxlor/froxlor

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0044 Published 2023-10-13 Fixed in 2.0.22 CWE-79

TI-2023-02990 CVE-2023-3192 · GHSA-jr66-9ghf-6gp3

Session Fixation in froxlor/froxlor

MEDIUM 58

Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00431 Published 2023-06-11 Fixed in 2.1.0 CWE-384

TI-2023-00536 CVE-2023-0565 · GHSA-vqqm-c9gx-773q

Business Logic Errors in froxlor/froxlor

MEDIUM 58

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00562 Published 2023-01-29 Fixed in 2.0.10 CWE-840

Open these records in search →