EUVD-2026-77453

Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

CVE-2026-90935

Froxlor before 2.3.7 contains an authorization bypass in the Mysqls.add API command : the mysql_server parameter is not validated against the customer's allowed_mysqlserver allowlist. A low-privileged attacker can supply a disallowed server index to create MySQL databases and users on forbidden s...

CVE-2026-90935 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API

Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

CVE-2026-90935 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API

Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-90936

Froxlor before version 2.3.7 contains an information disclosure vulnerability in customer_email.php . The root cause is a failure to properly scope sender alias lookups to the current customer. An authenticated attacker can supply arbitrary senderid parameters in delete confirmation requests to e...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-90935 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API

Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

EUVD-2026-77454

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2024-58383 Froxlor before 2.2.0 Insecure File Permissions mysql.conf

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

EUVD-2024-55764

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

CVE-2024-58383

Froxlor before 2.2.0 (including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via XML config templates in lib/configfiles/, despite the file containing the Froxlor SQL user's password. On systems with world-readable parent directories (default on Debian 12), any unprivileged lo...

CVE-2024-58383 Froxlor before 2.2.0 Insecure File Permissions mysql.conf

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

CVE-2024-58383 Froxlor before 2.2.0 Insecure File Permissions mysql.conf

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

PT-2026-91184

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

PT-2026-91211

Froxlor before 2.3.7 fails to validate the mysql server parameter against a customer's allowed mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

CVE-2024-58383: Incorrect Permission Assignment for Critical Resource

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

CVE-2026-90935: Improper Authorization

Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

CVE-2026-90936: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...