Skip to content
OpenAdvisories
High WID-SEC-2026-2113 6 CVEs

Froxlor: Mehrere Schwachstellen

Published Jun 28, 2026 · Updated Sep 14, 2026 · Revision 3 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um Cross-Site-Scripting- oder SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen, was möglicherweise weitere Angriffe ermöglicht.

Product

Froxlor ist eine Web-basierte Server-Management-Software.

Vulnerabilities 6

  • Critical 9.9
    CVE-2026-90937

    froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

    froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written…

    froxlor froxlor
  • Critical 9.0
    CVE-2026-62988

    Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

    Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins…

    froxlor froxlor froxlor/froxlor Packagist
  • High 8.7
    CVE-2026-54347

    Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

    Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap w…

    froxlor froxlor froxlor/froxlor Packagist
  • High 7.2
    CVE-2026-54348

    Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

    Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel_admins.ip without enforcing nu…

    froxlor froxlor froxlor/froxlor Packagist
  • Medium 6.5
    CVE-2026-55593

    Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection

    Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before ro…

    froxlor froxlor froxlor/froxlor Packagist
  • Medium 5.4
    CVE-2026-54543

    Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

    Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or…

    froxlor froxlor froxlor/froxlor Packagist

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-90937, EUVD-2026-77455

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-61220, EUVD-2026-61219, EUVD-2026-61218, EUVD-2026-61217, CVE-2026-62988, EUVD-2026-61216

  3. #1

    Initiale Fassung

References