froxlor
- Total products in the ecosystem
- 3
- Total vulnerabilities (90 days)
- 34
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, froxlor recorded 34 security vulnerabilities in the last 90 days across 1 products, including 23 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, froxlor had the most security vulnerabilities in the froxlor ecosystem, with 34 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121436Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpCVE-2026-121435Froxlor before 2.3.15 Authorization Bypass via Mysqls.add APICVE-2026-121434Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update APICVE-2026-113678Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic CronCVE-2026-113677Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-121436Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php | Exploitation statusNot exploited | FixYes |
| Published11/03/2026 |
| SeverityHigh |
CVE-2026-121435Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API | Exploitation statusNot confirmed | FixYes | Affected productfroxlor | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121434Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API | Exploitation statusNot confirmed | FixYes | Affected productfroxlor | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-113678Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published10/20/2026 | SeverityCritical |
|---|
CVE-2026-113677Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published10/20/2026 | SeverityMedium |
|---|
CVE-2026-113676Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published10/20/2026 | SeverityMedium |
|---|
CVE-2026-109963Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published10/13/2026 | SeverityMedium |
|---|
CVE-2026-109962Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published10/13/2026 | SeverityMedium |
|---|
CVE-2026-109961Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published10/13/2026 | SeverityHigh |
|---|
CVE-2026-109960Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published10/13/2026 | SeverityHigh |
|---|
CVE-2026-100720Froxlor before 2.3.12 Stored XSS via SSL certificate issuer | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityCritical |
|---|
CVE-2026-100719Froxlor before 2.3.12 Credential Disclosure via DirProtections API | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100718Froxlor before 2.3.12 Authentication Bypass via EmailSender.add | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100717froxlor before 2.3.12 CRLF Injection via validateUrl userinfo | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100716Froxlor before 2.3.12 Privilege Escalation via Symlink | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityCritical |
|---|
CVE-2026-100715Froxlor before 2.3.12 Arbitrary File Deletion via Symlink | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100714Froxlor before 2.3.12 Command Injection via letsencryptchallengepath | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityCritical |
|---|
CVE-2026-100713Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100712froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100711froxlor before 2.3.12 Authentication Bypass via Session Persistence | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100710Froxlor before 2.3.12 DKIM Private Key Disclosure via API | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-100709Froxlor before 2.3.12 2FA Bypass via Namespace Confusion | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100708Froxlor before 2.3.13 Private Key Disclosure via Certificates API | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-90937froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published09/14/2026 | SeverityCritical |
|---|
CVE-2026-90936Froxlor before 2.3.7 Information Disclosure via customer_email.php | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-90935Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/14/2026 | SeverityMedium |
|---|
CVE-2024-58383Froxlor before 2.2.0 Insecure File Permissions mysql.conf | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/14/2026 | SeverityHigh |
|---|
CVE-2026-90767Froxlor before 2.3.12 SSH Key Injection via authorized_keys | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published09/13/2026 | SeverityHigh |
|---|
CVE-2026-62988Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published08/18/2026 | SeverityCritical |
|---|
CVE-2026-55593Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-54543Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-54348Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-54347Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-52793Froxlor: API Authentication bypasses 2FA Authentication | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-41237Froxlor has an incomplete fix for CVE-2026-30932 | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published06/04/2026 | SeverityHigh |
|---|
CVE-2026-41236Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published06/04/2026 | SeverityHigh |
|---|
CVE-2026-41235Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published06/04/2026 | SeverityHigh |
|---|
CVE-2026-41234Froxlor: BIND Zone File Injection via TXT Record Content | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published06/04/2026 | SeverityHigh |
|---|
CVE-2026-41233Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published04/23/2026 | SeverityMedium |
|---|
CVE-2026-41232Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published04/23/2026 | SeverityMedium |
|---|
CVE-2026-41231Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published04/23/2026 | SeverityHigh |
|---|
CVE-2026-41230Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published04/23/2026 | SeverityHigh |
|---|
CVE-2026-41229Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published04/23/2026 | SeverityCritical |
|---|
CVE-2026-41228Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published04/23/2026 | SeverityCritical |
|---|
CVE-2026-30932Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-26279Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection | Exploitation statusNot exploited | FixYes | Affected productfroxlor | Published03/03/2026 | SeverityCritical |
|---|
CVE-2020-36978Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting | Exploitation statusActively exploited | FixNo | Affected productFroxlor Froxlor Server Management Panel | Published01/27/2026 | SeverityMedium |
|---|
CVE-2025-48958Froxlor has an HTML Injection Vulnerability | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published06/02/2025 | SeverityMedium |
|---|
CVE-2025-29773Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover | Exploitation statusActively exploited | FixNo | Affected productfroxlor | Published03/13/2025 | SeverityMedium |
|---|
CVE-2024-34070Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise | Exploitation statusActively exploited | FixYes | Affected productfroxlor | Published05/10/2024 | SeverityCritical |
|---|
77 Results | Page 1 of 2