Vulnerabilities

TI-2026-29842 CVE-2026-41233 · GHSA-jvx4-xv3m-hrj4

Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

MEDIUM 58

Froxlor is open source server administration software.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00264 Published 2026-04-23 Fixed in 2.3.6 CWE-863

TI-2026-29841 CVE-2026-41232 · GHSA-vmjj-qr7v-pxm6

Incorrect authorization in froxlor

MEDIUM 56

Froxlor is open source server administration software.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00231 Published 2026-04-23 Fixed in 2.3.6 CWE-863

TI-2026-29840 CVE-2026-41231 · GHSA-75h4-c557-j89r

Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron

HIGH 68

Froxlor is open source server administration software.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00414 Published 2026-04-23 Fixed in 2.3.6 CWE-59

TI-2026-29839 CVE-2026-41230 · GHSA-47hf-23pw-3m8c

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

HIGH 70

Froxlor is open source server administration software.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00347 Published 2026-04-23 Fixed in 2.3.6 CWE-93

TI-2026-29838 CVE-2026-41229 · GHSA-gc9w-cc93-rjv8

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

HIGH 74

Froxlor is open source server administration software.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0048 Published 2026-04-23 Fixed in 2.3.6 CWE-94

TI-2026-29837 CVE-2026-41228 · GHSA-w59f-67xm-rxx7

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

HIGH 76

Froxlor is open source server administration software.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00524 Published 2026-04-23 Fixed in 2.3.6 CWE-98

TI-2026-23757 CVE-2026-30932 · GHSA-x6w6-2xwp-3jh6

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

HIGH 70

Froxlor is open source server administration software.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00565 Published 2026-03-24 Fixed in 2.3.5 CWE-74

TI-2026-21248 CVE-2026-26279 · GHSA-33mp-8p67-xj7c

Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

MEDIUM 43

Froxlor is open source server administration software.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00931 Published 2026-03-03 Fixed in 2.3.4 CWE-482

TI-2025-31096 CVE-2025-48958 · GHSA-26xq-m8xw-6373

Froxlor has an HTML Injection Vulnerability

MEDIUM 58

Froxlor is open source server administration software.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.0035 Published 2025-06-02 Fixed in 2.2.6 CWE-79

TI-2025-21185 CVE-2025-29773 · GHSA-7j6w-p859-464f

Improper authentication in Froxlor

HIGH 69

Froxlor is open-source server administration software.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00289 Published 2025-03-13 Fixed in 2.2.6 CWE-287

TI-2023-27484 CVE-2023-50256 · GHSA-625g-fm5w-w7w4

Froxlor username/surname AND company field Bypass

MEDIUM 40

Froxlor is open source server administration software.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00716 Published 2024-01-03 Fixed in 2.1.2 CWE-20

TI-2023-05587 CVE-2023-6069 · GHSA-4jch-8qq5-hqg6

Improper Link Resolution Before File Access in froxlor/froxlor

MEDIUM 44

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00829 Published 2023-11-10 Fixed in 2.1.0, 2.1.0-beta1 CWE-59

TI-2023-04445 CVE-2023-4829 · GHSA-cvwv-h85m-w37h

Cross-site Scripting (XSS) - Stored in froxlor/froxlor

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0044 Published 2023-10-13 Fixed in 2.0.22 CWE-79

TI-2023-05122 CVE-2023-5564 · GHSA-j5hq-6frc-64v3

Cross-site Scripting (XSS) - Stored in froxlor/froxlor

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00418 Published 2023-10-13 Fixed in 2.1.0-dev1 CWE-79

TI-2023-03980 CVE-2023-4304 · GHSA-9rmf-6qgj-g3wj

Business Logic Errors in froxlor/froxlor

LOW 19

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00591 Published 2023-08-11 Fixed in 2.0.22,2.1.0, 2.0.22 CWE-840

TI-2023-03425 CVE-2023-3668 · GHSA-c6v5-pf66-xfq8

Improper Encoding or Escaping of Output in froxlor/froxlor

HIGH 67

Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01008 Published 2023-07-14 Fixed in 2.0.21 CWE-116

TI-2023-02990 CVE-2023-3192 · GHSA-jr66-9ghf-6gp3

Session Fixation in froxlor/froxlor

MEDIUM 58

Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00431 Published 2023-06-11 Fixed in 2.1.0 CWE-384

TI-2023-02973 CVE-2023-3173 · GHSA-chw4-88xc-79w6

Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor

HIGH 82

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01119 Published 2023-06-09 Fixed in 2.0.20 CWE-307

TI-2023-02972 CVE-2023-3172 · GHSA-ghqq-jfx7-f6m9

Path Traversal in froxlor/froxlor

HIGH 65

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01206 Published 2023-06-09 Fixed in 2.0.20 CWE-22

TI-2023-02494 CVE-2023-2666 · GHSA-4gm9-c9jq-g523

Allocation of Resources Without Limits or Throttling in froxlor/froxlor

HIGH 68

Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00681 Published 2023-05-12 Fixed in 2.0.16 CWE-770

TI-2023-01911 CVE-2023-2034 · GHSA-qwvp-g9j7-28f6

Unrestricted Upload of File with Dangerous Type in froxlor/froxlor

HIGH 78

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.7143 Published 2023-04-14 Fixed in 2.0.14 CWE-434

TI-2023-01234 CVE-2023-1307 · GHSA-j83x-r9qq-9g4v

Authentication Bypass by Primary Weakness in froxlor/froxlor

HIGH 82

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01073 Published 2023-03-10 Fixed in 2.0.13 CWE-305

TI-2023-00978 CVE-2023-1033 · GHSA-p7qq-rrvw-x55x

Cross-Site Request Forgery (CSRF) in froxlor/froxlor

HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00324 Published 2023-02-25 Fixed in 2.0.11 CWE-352

TI-2023-00832 CVE-2023-0877 · GHSA-vp4r-h765-5mwp

Code Injection in froxlor/froxlor

HIGH 73

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03928 Published 2023-02-17 Fixed in 2.0.11 CWE-94

TI-2023-00636 CVE-2023-0671 · GHSA-9fqc-9cpr-w73q

Code Injection in froxlor/froxlor

HIGH 73

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01119 Published 2023-02-04 Fixed in 2.0.10 CWE-94

Vulnerabilities

Filters