Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: froxlor 2.3.15 Clear all filters
TI-2026-84318 CVE-2026-121436 · GHSA-2qgh-vqj2-gcjx

Information disclosure in Froxlor exposes API keys via api_keys.php

Priority MEDIUM 40

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00446 Published 2026-11-03 Fixed in 2.3.15 CWE-200
TI-2026-84317 CVE-2026-121435 · GHSA-7fmq-3hpx-jc23

Authorization bypass in Froxlor lets customers create MySQL databases

Priority LOW 23

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00177 Published 2026-11-03 Fixed in 2.3.15 CWE-862
TI-2026-84316 CVE-2026-121434 · GHSA-hxjh-8h5v-fp7m

Missing authorization in Froxlor lets customers overwrite managed certificates

Priority MEDIUM 57

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00156 Published 2026-11-03 Fixed in 2.3.15 CWE-862