Froxlor < 0.10.38.2. - HTML Injection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. id: CVE-2022-3869 info: name: Froxlor TEST" matchers-condition: and matchers: - type: word part: body words: - 'The message to ""TEST" failed' - type: word part: header words: - "text/html" - type: status status: - 200 d...

Exploit-CVE-2024-34070

Exploit for CVE-2024-34070 Credit to froxlor for the vuln discover. Check here for more. Train yourself on Hack The Box. Exploitation...

CVE-2023-0315

CVE-2023-0315 The official exploit for Froxlor Remote Code Execution CVE-2023-0315...

CVE-2026-121434

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2026-121436

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121435

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...

CVE-2026-121436

Froxlor versions 2.3.8 through 2.3.14 are vulnerable to an information disclosure flaw in api_keys.php . This issue stems from an unscoped WHERE 1 query , which allows administrators possessing the customers_see_all privilege to view the API keys and secrets of every account. A significant securi...

EUVD-2026-115858

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121435 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...

CVE-2026-121434 Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2026-121434

Froxlor versions 2.3.0 before 2.3.15 are vulnerable to an authorization bypass within the Certificates.add and Certificates.update API commands. The flaw exists because the system fails to verify if a domain's certificate is Let's Encrypt-managed. An attacker with API access can overwrite managed...

EUVD-2026-115856

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2026-121435

Froxlor versions before 2.3.15 are affected by an authorization bypass vulnerability in the Mysqls.add API endpoint. The root cause is a missing customer_hide_options check, which allows authenticated customers to create MySQL databases even if the administrator has globally disabled the MySQL fe...

EUVD-2026-115857

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...

CVE-2026-121434 Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2026-121436: froxlor: Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with…

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121435: froxlor: Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create…

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...