Product by Open Source

    Froxlor

    17 known vulnerabilities in Froxlor (Open Source), 0 of them actively exploited (CISA KEV).

    Key figures

    17

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Froxlor (Open Source)
    CriticalCVE-2026-113678

    Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

    also in 1 other product

    		9.9
    CriticalCVE-2023-3173

    Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor

    also in 2 other products

    		9.8
    HighCVE-2026-54348

    Froxlor: SQL Injection

    also in 1 other product

    		7.2
    HighCVE-2026-54347

    Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

    also in 1 other product

    		8.7
    HighCVE-2026-109960

    Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

    also in 1 other product

    		7.7
    HighCVE-2026-90767

    Froxlor before 2.3.12 SSH Key Injection via authorized_keys

    also in 1 other product

    		6.5
    HighCVE-2026-109961

    Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

    also in 1 other product

    		8.5
    HighCVE-2026-41236

    Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

    also in 1 other product

    		8.8
    MediumCVE-2026-113677

    Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

    also in 1 other product

    		5.4
    MediumCVE-2026-113676

    Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

    also in 1 other product

    		4.3
    HighCVE-2026-41237

    Froxlor has an incomplete fix for CVE-2026-30932

    also in 1 other product

    		—
    HighCVE-2026-41235

    Froxlor: Incorrect Authorization

    also in 1 other product

    		—
    MediumCVE-2026-54543

    Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

    also in 1 other product

    		5.4
    HighCVE-2026-41234

    Froxlor: BIND Zone File Injection via TXT Record Content

    also in 1 other product

    		7.6
    MediumCVE-2026-109963

    Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

    also in 1 other product

    		4.3
    MediumCVE-2026-109962

    Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

    also in 1 other product

    		4.3
    MediumCVE-2026-55593

    Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection

    also in 1 other product

    		6.5

    All products by Open Source