CVE-2025-29773 Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users such as resellers or customers to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This...

Froxlor security vulnerabilities

Froxlor is a suite of lightweight server management software from the Froxlor team. A security vulnerability exists in Froxlor versions prior to 2.2.6. An attacker exploiting this vulnerability could create accounts with the same email address as an existing account, potentially leading to accoun...

CVE-2025-29773: Improper Authentication

Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users such as resellers or customers to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This...

Cross-site Scripting (XSS)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the domain field in the email creation form by redirecting users to malicious external websites. Details Cross-site scripting or XSS is a code...

GHSA-7J6W-P859-464F Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

Summary the vulnerability is that users such as resellers or customers are able to create accounts with the same email address as an existing account e.g., if the admin has [email protected], others can also create an account using the same email. This creates potential issues with account...

Improper Authentication

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Improper Authentication due to missing restrictions to create accounts using the same email address, allowing an attacker to escalate privileges or take over accounts by registering...

PT-2025-23501 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: Froxlor versions prior to 2.2.6 Description: The issue is an HTML Injection vulnerability in the customer account portal, allowing an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credenti...

PT-2025-11215 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: Froxlor versions prior to 2.2.6 Description: Froxlor is open-source server administration software. A vulnerability allows users, such as resellers or customers, to create accounts with the same email address as an existing account, creating...

CVE-2022-3721

Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39...

Improper File Permissions

froxlor/froxlor is vulnerable to Improper File Permissions. The vulnerability is due to XML templates in certain branches of Froxlor setting chmod 644 for /etc/pure-ftpd/db/mysql.conf, which allows an attacker to expose the to all users with access to the system...

GHSA-34QG-65M4-F23M Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>

Summary In Froxlor 2.1.9 and in the HEADs of the main, v2.2 and v2.1 branches , the XML templates in lib/configfiles/ set chmod 644 for /etc/pure-ftpd/db/mysql.conf, although that file contains . At least on Debian 12, all parent directories of /etc/pure-ftpd/db/mysql.conf are world readable by...

Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>

Summary In Froxlor 2.1.9 and in the HEADs of the main, v2.2 and v2.1 branches , the XML templates in lib/configfiles/ set chmod 644 for /etc/pure-ftpd/db/mysql.conf, although that file contains . At least on Debian 12, all parent directories of /etc/pure-ftpd/db/mysql.conf are world readable by...

PT-2024-40042 · Percona +2 · Percona +2

Name of the Vulnerable Software and Affected Versions: Froxlor versions 2.1.9 and earlier Description: The issue concerns the exposure of MySQL database credentials due to incorrect file permissions. In affected Froxlor instances configured to use pure-ftpd, the XML templates set chmod 644 for...

PT-2026-91184

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.2.0 Description Instances configured to use pure-ftpd are affected by an issue where the XML configuration templates in lib/configfiles/ generate the /etc/pure-ftpd/db/mysql.conf file with mode 0644. Because this fi...

OPENSUSE-SU-2024:10487-1 froxlor-0.9.38.4-1.1 on GA media

These are all security issues fixed in the froxlor-0.9.38.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-34070

Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting XSS vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on t...

Froxlor security vulnerabilities

Froxlor is a lightweight server management software from the Froxlor team. A security vulnerability exists in Froxlor versions prior to 2.1.9, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows unauthenticated users to inject malicious scripts...

CVE-2024-34070: Improper Neutralization of Input During Web Page Generation

Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting XSS vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on t...

Cross-Site Scripting (XSS)

froxlor/froxlor is vulnerable to Cross-Site Scripting. The vulnerability is due to inadequate sanitization of user input in the loginname parameter during failed login attempts, which allows attackers to inject and store malicious scripts that are executed when an administrator views the System...

GHSA-X525-54HF-XR53 Blind XSS Leading to Froxlor Application Compromise

Description: A Stored Blind Cross-Site Scripting XSS vulnerability has been identified in the Failed Login Attempts Logging Feature of the Froxlor Application. Stored Blind XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious...