Skip to content
OpenAdvisories

Package · Packagist

froxlor/froxlor

60 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-62988

    Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

    Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins…

    froxlor froxlor froxlor/froxlor Packagist
  • Critical 9.1
    CVE-2026-41229

    Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

    Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission …

    froxlor froxlor froxlor/froxlor Packagist
  • Critical 10.0
    CVE-2026-41228

    Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

    Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against the list of available language files. An authenticated cust…

    froxlor froxlor froxlor/froxlor Packagist
  • Critical 9.1
    CVE-2026-26279

    Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

    Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to …

    froxlor froxlor froxlor/froxlor Packagist
  • Critical 9.7
    CVE-2024-34070 Public exploit

    Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise

    Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious…

    froxlor froxlor froxlor/froxlor Packagist
  • Critical 9.9
    CVE-2023-6069

    Improper Link Resolution Before File Access in froxlor/froxlor

    Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Critical 9.1
    CVE-2023-3668

    Improper Encoding or Escaping of Output in froxlor/froxlor

    Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Critical 9.8
    CVE-2023-3173

    Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor

    Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Critical 9.1
    CVE-2023-2034 EPSS 71%

    Unrestricted Upload of File with Dangerous Type in froxlor/froxlor

    Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Critical 9.8
    CVE-2023-1307

    Authentication Bypass by Primary Weakness in froxlor/froxlor

    Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Critical 9.1
    CVE-2023-0877

    Code Injection in froxlor/froxlor

    Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Critical 9.9
    CVE-2023-0671

    Code Injection in froxlor/froxlor

    Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Critical 9.8
    CVE-2021-42325 Public exploit EPSS 12%

    Froxlor SQL injection vulnerability

    Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.

    froxlor/froxlor Packagist
  • Critical 9.8
    CVE-2016-5100

    Froxlor guessable password reset token

    Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.

    froxlor/froxlor Packagist