Froxlor < 0.10.38.2. - HTML Injection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. id: CVE-2022-3869 info: name: Froxlor TEST" matchers-condition: and matchers: - type: word part: body words: - 'The message to ""TEST" failed' - type: word part: header words: - "text/html" - type: status status: - 200 di...

CVE-2026-121436

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121435

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...

CVE-2026-121436

Froxlor versions 2.3.8 through 2.3.14 are vulnerable to an information disclosure flaw in api_keys.php . This issue stems from an unscoped WHERE 1 query , which allows administrators possessing the customers_see_all privilege to view the API keys and secrets of every account. A significant securi...

CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

EUVD-2026-115858

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121435 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...

CVE-2026-121435

Froxlor versions before 2.3.15 are affected by an authorization bypass vulnerability in the Mysqls.add API endpoint. The root cause is a missing customer_hide_options check, which allows authenticated customers to create MySQL databases even if the administrator has globally disabled the MySQL fe...

EUVD-2026-115856

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

EUVD-2026-115857

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...

CVE-2026-121434

Froxlor versions 2.3.0 before 2.3.15 are vulnerable to an authorization bypass within the Certificates.add and Certificates.update API commands. The flaw exists because the system fails to verify if a domain's certificate is Let's Encrypt-managed. An attacker with API access can overwrite managed...

CVE-2026-121436: froxlor: Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with…

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121435: froxlor: Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create…

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...

CVE-2026-121434: froxlor: Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API…

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2024-34070

CVE-2024-34070 Froxlor PoC Python proof of concept for CVE-2024-34070, a stored XSS issue in Froxlor before 2.1.9 through failed login attempts written to the system log. WARNING This project is for authorized security testing, CTF labs, and educational use only. Do not run this against systems y...

Exploit-CVE-2024-34070

Exploit for CVE-2024-34070 Credit to froxlor for the vuln discover. Check here for more. Train yourself on Hack The Box. Exploitation...

CVE-2023-0315

CVE-2023-0315 The official exploit for Froxlor Remote Code Execution CVE-2023-0315...

CVE-2026-113678

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document...

CVE-2026-113677

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...