Read the docs
TI-2023-27484 Aliases CVE-2023-50256GHSA-625g-fm5w-w7w4

Froxlor username/surname AND company field Bypass

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00716 54th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Froxlor (Froxlor): 2.1.2froxlor/froxlor (Packagist): 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
froxlorFroxlorbefore 2.1.22.1.2Patch availableCNA
—froxlor/froxlor (Packagist)before 2.1.22.1.2Patch availableGHSA-625g-fm5w-w7w4
  • Froxlor Vendorfroxlor Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA
  • froxlor/froxlor (Packagist) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-625g-fm5w-w7w4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*before 2.1.2Vulnerablefroxlor
  • cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:* Versions before 2.1.2 Vulnerable ·froxlor

Remediation

  • Fix · CNA Froxlor (Froxlor) Fixed in 2.1.2
  • Fix · GHSA-625g-fm5w-w7w4 froxlor/froxlor (Packagist) Fixed in 2.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50256
  2. 2026-10-03 Alias added: GHSA-625g-fm5w-w7w4

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2023-00300 Command Injection in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2023-02973 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01234 Authentication Bypass by Primary Weakness in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01911 Unrestricted Upload of File with Dangerous Type in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2026-29837 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-29838 Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) CVSS 3.1CRITICAL 9.1
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences