CVE-2026-100708: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

PT-2026-99379

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.13 Description An issue exists where the raw PEM TLS private-key content stored in the ssl key file column is returned verbatim in JSON responses. This occurs because results from domain ssl settings queries are...