CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

EUVD-2026-61219

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347

In Froxlor prior to 2.3.8, a low-privileged authenticated customer can store JavaScript in a DNS TXT record; it is rendered unescaped via the Twig |raw filter and an unescaped Text::wordwrap callback, auto-executing when an admin views the DNS table, enabling session theft and full admin account ...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54543

In Froxlor before 2.3.8, an authenticated customer with DNS-zone permissions can inject crafted record or type field values (line delimiters, tabs, semicolons) into lib/Froxlor/Api/Commands/DomainZones.php, which DnsEntry.php serializes into a BIND zone file, creating extra resource-record lines ...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

EUVD-2026-61217

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-70667

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

EUVD-2026-61151

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-70667 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-70667 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-70667

Netflix Lemur prior to 1.9.3 contains a bypass of its SSRF mitigation in _validate_revocation_url (lemur/certificates/verify.py). Two vectors exist: (1) the CRL requests.get call follows HTTP redirects without re-validating each Location target, allowing an attacker-controlled public URL to redir...

CVE-2026-68927

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

GHSA-95PX-34X5-P37H MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

CVE-2026-68927

MobSF (Mobile Security Framework) prior to 4.5.1 contains an SSRF port restriction bypass in the Android App Link assetlinks checker. The function get_browsable_activities in manifest_analysis.py validates only the android:host value via valid_host(), but appends a separately supplied android:por...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...