Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: froxlor 2.3.15 Clear all filters
TI-2026-76945 CVE-2026-113678 · GHSA-j3hm-8rm8-m243

Symlink following in Froxlor enables root privilege escalation

Priority HIGH 76

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cr…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00632 Published 2026-10-20 Fixed in 2.3.15 CWE-59
TI-2026-76944 CVE-2026-113677 · GHSA-9rxg-hj9r-x482

Missing authorization in Froxlor SubDomains.delete API

Priority MEDIUM 57

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main do…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0045 Published 2026-10-20 Fixed in 2.3.15 CWE-862
TI-2026-76943 CVE-2026-113676 · GHSA-fhvc-6pwx-657g

Authorization bypass in Froxlor Admins.get API exposes admin records

Priority MEDIUM 57

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-20 Fixed in 2.3.15 CWE-863