Vendor
froxlor
77 known vulnerabilities.
34 results · Clear filters · Feed
-
Medium 4.3
Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when t…
-
Medium 5.4
Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API
Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed c…
-
Medium 4.3
Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to r…
-
Medium 5.4
Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web U…
-
Medium 4.3
Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjob…
-
Medium 4.3
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their…
-
Medium 6.5
Froxlor before 2.3.12 Credential Disclosure via DirProtections API
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling o…
-
Medium 6.5
froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token…
-
Medium 4.9
Froxlor before 2.3.12 DKIM Private Key Disclosure via API
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodif…
-
Medium 4.3
Froxlor before 2.3.7 Information Disclosure via customer_email.php
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid para…
-
Medium 4.3
Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypass…
-
Medium 6.5
Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain …
-
Medium 6.5
Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection
Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before ro…
-
Medium 5.4
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or…
-
Medium 5.4
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used without validation when the calling reseller does not have the `customers_see_all` permission. This…
-
Medium 5.0
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing
Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead o…
-
Medium 6.4
Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting
Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators…
-
Medium 5.5
Froxlor has an HTML Injection Vulnerability
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credent…
-
Medium 5.8
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover
Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account i…
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in froxlor/froxlor
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.
-
Medium 5.2
Cross-site Scripting (XSS) - Stored in froxlor/froxlor
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.
-
Medium 4.2
Session Fixation in froxlor/froxlor
Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
-
Medium 6.5
Path Traversal in froxlor/froxlor
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
-
Medium 6.8
Allocation of Resources Without Limits or Throttling in froxlor/froxlor
Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.
-
Medium 6.8
Cross-Site Request Forgery (CSRF) in froxlor/froxlor
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.
-
Medium 5.3
Unchecked Error Condition in froxlor/froxlor
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 6.2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
-
Medium 5.5
Business Logic Errors in froxlor/froxlor
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.4
Weak Password Requirements in froxlor/froxlor
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 6.8
Path Traversal: '\..\filename' in froxlor/froxlor
Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.
-
Medium 6.5
Improper Authorization in froxlor/froxlor
Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
-
Medium 5.3
Argument Injection in froxlor/froxlor
Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
-
Medium 6.5
Code Injection in froxlor/froxlor
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in froxlor/froxlor
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.