froxlor vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-113678 Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of aCritical 9.4 · Oct 20, 2026
• CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS High 8.4 · Oct 13, 2026
• CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a High 8.7 · Oct 13, 2026
• CVE-2026-100720 Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting.Critical 9.3 · Sep 26, 2026
• CVE-2026-100719 Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes.High 7.1 · Sep 26, 2026
• CVE-2026-100718 Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command.High 7.1 · Sep 26, 2026
• CVE-2026-100717 froxlor is a server administration panel.High 8.5 · Sep 26, 2026
• CVE-2026-100716 Froxlor is a server administration panel.Critical 9.4 · Sep 26, 2026
• CVE-2026-100715 Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task.High 8.5 · Sep 26, 2026
• CVE-2026-100714 Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no sCritical 9.4 · Sep 26, 2026
• CVE-2026-100713 Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php,High 7.1 · Sep 26, 2026
• CVE-2026-100712 froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g.High 7.1 · Sep 26, 2026
• CVE-2026-100711 froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed.High 8.7 · Sep 26, 2026
• CVE-2026-100709 Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-tokHigh 7.7 · Sep 26, 2026
• CVE-2026-100708 Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.geHigh 7.1 · Sep 26, 2026
• CVE-2026-90937 froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or ApacCritical 9.4 · Sep 14, 2026
• CVE-2024-58383 Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/cHigh 8.4 · Sep 14, 2026
• CVE-2026-90767 Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into auHigh 7.1 · Sep 13, 2026
• CVE-2026-62988 Froxlor is open source server administration software.Critical 9 · Aug 18, 2026
• CVE-2026-54348 Froxlor is open source server administration software.High 7.2 · Aug 18, 2026
• CVE-2026-54347 Froxlor is open source server administration software.High 8.7 · Aug 18, 2026
• CVE-2026-52793 Froxlor is open source server administration software.High 8.1 · Aug 18, 2026
• CVE-2026-41237 Froxlor is open source server administration software.High 8.6 · Jun 4, 2026
• CVE-2026-41236 Froxlor is open source server administration software.High 8.8 · Jun 4, 2026
• CVE-2026-41235 Froxlor is open source server administration software.High 8.6 · Jun 4, 2026