CVE-2020-10237

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...

EUVD-2015-5904

Malware in sbrugna...

EUVD-2023-1047

Malicious code in bioql PyPI...

EUVD-2022-7359

Malicious code in bioql PyPI...

EUVD-2022-7757

Malicious code in bioql PyPI...

EUVD-2025-6274

Malicious code in bioql PyPI...

EUVD-2022-1772

Malicious code in bioql PyPI...

EUVD-2022-4985

Malicious code in bioql PyPI...

EUVD-2022-4325

Malicious code in bioql PyPI...

EUVD-2023-0570

Malicious code in bioql PyPI...

EUVD-2022-4658

Malicious code in bioql PyPI...

EUVD-2022-4219

Malicious code in bioql PyPI...

EUVD-2025-16633

Malicious code in bioql PyPI...

CVE-2025-48958 Froxlor has an HTML Injection Vulnerability

Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by...

CVE-2022-3017

Cross-Site Request Forgery CSRF in GitHub repository froxlor/froxlor prior to 0.10.38...

CVE-2022-4868

Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1...

CVE-2021-42325

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...

CVE-2020-10235

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...

CVE-2020-10236

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...