CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...

CVE-2026-109962

Froxlor versions 0.10.0 before 2.3.14 are vulnerable to a missing authorization flaw in the MysqlServer and Cronjobs APIs. This vulnerability allows reseller accounts to bypass intended restrictions and read administrative-only configurations by calling MysqlServer.listing, MysqlServer.get, or Cr...

CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...

CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...

MySQL2 for Node Arbitrary Code Injection

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...