Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: froxlor 2.3.14 Clear all filters
TI-2026-71730 CVE-2026-109963 · GHSA-c3jc-298j-rpv5

Insecure direct object reference in Froxlor email template editor

Priority MEDIUM 57

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00256 Published 2026-10-13 Fixed in 2.3.14 CWE-639
TI-2026-71729 CVE-2026-109962 · GHSA-c54j-3x5v-ch23

Missing authorization in Froxlor MySQL server and cronjob API

Priority MEDIUM 57

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00256 Published 2026-10-13 Fixed in 2.3.14 CWE-285
TI-2026-71728 CVE-2026-109961 · GHSA-5986-h43p-hp85

Newline injection in Froxlor enables local privilege escalation

Priority HIGH 70

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parame…

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-13 Fixed in 2.3.14 CWE-74
TI-2026-71727 CVE-2026-109960 · GHSA-wj7h-phvf-62w3

Stored cross-site scripting in Froxlor via customer theme value

Priority HIGH 73

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php.

CVSS 4.0HIGH 8.7 Network Low privileges User interaction EPSS 0.00292 Published 2026-10-13 Fixed in 2.3.14 CWE-79