CVE-2026-100708

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Certificates.get and Certificates.listing API commands, which return the sslkeyfile field containing raw PEM TLS private-key content in JSON responses. An...

CVE-2026-100708 Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CVE-2026-100708 Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CVE-2026-100708

Froxlor versions before 2.3.13 are vulnerable to private key disclosure via the Certificates.get and Certificates.listing API commands. The root cause is that the results of underlying domain_ssl_settings queries are processed by ApiCommand::response() without any field stripping or allowlist, ca...

CVE-2026-100708 Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

EUVD-2026-87681

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CVE-2026-100708: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

PT-2026-99379

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.13 Description An issue exists where the raw PEM TLS private-key content stored in the ssl key file column is returned verbatim in JSON responses. This occurs because results from domain ssl settings queries are...