1063 matches found
PT-2026-77301
Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...
PT-2026-80229
Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters. The stronger variant is in record. An authenticated customer with...
PT-2026-77299
Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...
PT-2026-80243
Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...
PT-2026-77300
Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.8 Description An authenticated administrator with change serversettings permission can perform a SQL injection attack. The 'Admins.add' and 'Admins.update' endpoints in lib/Froxlor/Api/Commands/Admins.php accept a...
Froxlor < 0.10.38.2. - HTML Injection Detection
HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. !/usr/bin/env python3 -- coding: utf-8 -- """HTML Injection in GitHub repository froxlor/froxlor prior to 0.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...
Froxlor Server Management Backup File - Detect
Froxlor Server Management backup file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Froxlor Server Management backup file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Froxlor Server...
Froxlor Server Management - Installer Detection
Detects the Froxlor Server Management Panel installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the Froxlor Server Management Panel installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...
Froxlor Server Management - Cross-Site Scripting Detection
Froxlor Server Management is susceptible to cross-site scripting via clicking the forgot password link. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...
Froxlor Detect
Detects Froxlor Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Froxlor Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Froxlor Detect', 'description': 'Detects Froxlor Detect.', 'author':...
Froxlor Server Management Login Panel - Detect
Froxlor Server Management login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Froxlor Server Management login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Froxlor Server...
Authentication Bypass
Froxlor is vulnerable to Authentication Bypass. The vulnerability is due to the two-factor validation endpoint issuing a full authenticated session without verifying the user's password, CSRF token, or rate limits, which allows an attacker to brute-force valid TOTP codes and obtain an authenticat...
Server-Side Request Forgery (SSRF)
Froxlor is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the X-Forwarded-Host and X-Forwarded-Proto headers when constructing URLs for cURL requests, which allows an unauthenticated attacker to spoof these headers and force the server to issue...
Improper Authorization
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Improper Authorization through the Mysqls.add process. An attacker can create databases and users on unauthorized MySQL servers by supplying a disallowed server index in the API...
Authorization Bypass Through User-Controlled Key
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the customeremail.php process. An attacker can access other users' allowed sender aliases by supplying arbitrary senderid values in...
Froxlor: Authenticated customers can read other customers' allowed sender aliases
Summary An authenticated customer can read other customers' allowed sender aliases from Froxlor's sender-delete confirmation page when mail.enableallowsender is enabled. customeremail.php loads allowedsender by global auto-increment senderid alone, so a customer can enumerate foreign sender alias...
GHSA-MR9H-45P9-FG8H Froxlor: Authenticated customers can read other customers' allowed sender aliases
Summary An authenticated customer can read other customers' allowed sender aliases from Froxlor's sender-delete confirmation page when mail.enableallowsender is enabled. customeremail.php loads allowedsender by global auto-increment senderid alone, so a customer can enumerate foreign sender alias...
PT-2026-57600
Summary The Mysqls.add API command lib/Froxlor/Api/Commands/Mysqls.php accepts a customer-controlled mysql server parameter and only validates that the value is numeric and that the server index exists in userdata.inc.php. It never checks the value against the calling customer's allowed mysqlserv...
PT-2026-57599
Summary An authenticated customer can read other customers' allowed sender aliases from Froxlor's sender-delete confirmation page when mail.enable allow sender is enabled. customer email.php loads allowed sender by global auto-increment senderid alone, so a customer can enumerate foreign sender...
