4 matches found
CVE-2026-109963
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...
CVE-2026-109963
Froxlor versions prior to 2.3.14 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the email template editor via admin_templates.php. The root cause is that the system fetches the mail body using mailbodyid without performing an adminid ownership check. This allows...
CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...
EUVD-2026-98667
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...