CVE-2026-121436

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436

Froxlor versions 2.3.8 through 2.3.14 are vulnerable to an information disclosure flaw in api_keys.php . This issue stems from an unscoped WHERE 1 query , which allows administrators possessing the customers_see_all privilege to view the API keys and secrets of every account. A significant securi...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Domains::get, Domains::listing, SubDomains::get, and SubDomains::listing API functions. An attacker can access DKIM private signing keys belonging to othe...