CVE-2023-0315

CVE-2023-0315 The official exploit for Froxlor Remote Code Execution CVE-2023-0315...

Froxlor < 0.10.38.2. - HTML Injection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. id: CVE-2022-3869 info: name: Froxlor TEST" matchers-condition: and matchers: - type: word part: body words: - 'The message to ""TEST" failed' - type: word part: header words: - "text/html" - type: status status: - 200 d...

Exploit-CVE-2024-34070

Exploit for CVE-2024-34070 Credit to froxlor for the vuln discover. Check here for more. Train yourself on Hack The Box. Exploitation...

CVE-2026-113676

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113678

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document...

CVE-2026-113677

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

CVE-2026-113678

Froxlor versions prior to 2.3.15 are vulnerable to a symlink following issue within the Statistics::makeChownWithNewStats function. This flaw allows authenticated customers to achieve privilege escalation by abusing a root-run traffic cron. An attacker can replace the goaccess statistics director...

CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document...

EUVD-2026-105094

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document...

CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document...

CVE-2026-113676

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to an authorization bypass in the Admins.get API command. This vulnerability is caused by identifier confusion , allowing authenticated resellers to read sensitive records belonging to other administrators. By providing their own loginname comb...

CVE-2026-113677

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to a missing authorization flaw in the SubDomains.delete API command. This allows authenticated customers to delete reseller-provisioned main domains by providing a specific main domain ID, bypassing web UI restrictions. Successful exploitation...

EUVD-2026-105093

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

EUVD-2026-105092

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113677 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113677 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

CVE-2024-34070

CVE-2024-34070 Froxlor PoC Python proof of concept for CVE-2024-34070, a stored XSS issue in Froxlor before 2.1.9 through failed login attempts written to the system log. WARNING This project is for authorized security testing, CTF labs, and educational use only. Do not run this against systems y...