CVE-2024-34070

CVE-2024-34070 Froxlor PoC Python proof of concept for CVE-2024-34070, a stored XSS issue in Froxlor before 2.1.9 through failed login attempts written to the system log. WARNING This project is for authorized security testing, CTF labs, and educational use only. Do not run this against systems y...

Froxlor < 0.10.38.2. - HTML Injection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. id: CVE-2022-3869 info: name: Froxlor TEST" matchers-condition: and matchers: - type: word part: body words: - 'The message to ""TEST" failed' - type: word part: header words: - "text/html" - type: status status: - 200 d...

CVE-2023-0315

CVE-2023-0315 The official exploit for Froxlor Remote Code Execution CVE-2023-0315...

CVE-2026-109963

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109962

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...

CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...

CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...

CVE-2026-109963

Froxlor versions prior to 2.3.14 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the email template editor via admin_templates.php. The root cause is that the system fetches the mail body using mailbodyid without performing an adminid ownership check. This allows...

CVE-2026-109962

Froxlor versions 0.10.0 before 2.3.14 are vulnerable to a missing authorization flaw in the MysqlServer and Cronjobs APIs. This vulnerability allows reseller accounts to bypass intended restrictions and read administrative-only configurations by calling MysqlServer.listing, MysqlServer.get, or Cr...

CVE-2026-109961

Froxlor versions 0.10.0 before 2.3.14 are vulnerable to a newline injection flaw in the Ftps.add API's additional_members parameter. This vulnerability allows authenticated customers to inject arbitrary entries into the root-owned NSS group database. Because the REBUILD_NSSUSERS cron job writes t...

CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additionalmembers parameter of the Ftps.add API. Attackers can embed newline characters that the...

CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...

CVE-2026-109960

Froxlor versions 2.0.0 before 2.3.14 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. Authenticated customers can inject malicious HTML and JavaScript by providing a craftied theme value via customer_index.php . The payload executes in an administrator's browser when they view the cust...

Exploit-CVE-2024-34070

Exploit for CVE-2024-34070 Credit to froxlor for the vuln discover. Check here for more. Train yourself on Hack The Box. Exploitation...

PT-2026-111557

Name of the Vulnerable Software and Affected Versions Froxlor versions 0.10.0 through 2.3.13 Description Missing authorization allows reseller accounts to access MySQL server and cronjob configurations intended only for full administrators. This is achieved by using API read commands through the...

CVE-2026-109962: Improper Authorization

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...

CVE-2026-109961: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additionalmembers parameter of the Ftps.add API. Attackers can embed newline characters that the...

CVE-2026-109960: Improper Neutralization of Input During Web Page Generation

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...