Skip to content
OpenAdvisories
High WID-SEC-2026-3629 4 CVEs

Froxlor: Mehrere Schwachstellen

Published Sep 28, 2026 · Updated Oct 13, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und möglicherweise erweiterte Berechtigungen zu erlangen.

Product

Froxlor ist eine Web-basierte Server-Management-Software.

Vulnerabilities 4

  • High 8.5
    CVE-2026-109961

    Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

    Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can …

    froxlor froxlor
  • High 7.7
    CVE-2026-109960

    Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

    Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the custo…

    froxlor froxlor
  • Medium 4.3
    CVE-2026-109962

    Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

    Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjob…

    froxlor froxlor
  • Medium 4.3
    CVE-2026-109963

    Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

    Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their…

    froxlor froxlor

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References