Froxlor
Monthly
Froxlor before 2.3.15 allows an authenticated hosting customer with write access to their document root to escalate to root by replacing the statistics directory with a symlink, so the root-run traffic cron's recursive chown follows the link and changes ownership of arbitrary host directories. Exploitation requires a valid customer account, enabled goaccess/webalizer/awstats statistics, and execution of the scheduled traffic cron; no public exploit identified at time of analysis. Vendor-released patch: 2.3.15.
Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.
Stored cross-site scripting in Froxlor 2.0.0 before 2.3.14 allows an authenticated customer to inject HTML/JavaScript through a theme value set in customer_index.php; the payload only executes when an administrator later views the customer overview with the Theme column enabled. Successful exploitation can abuse the administrator's CSRF token to create administrator accounts or change server settings. No public exploit code or CISA KEV listing is identified in the available data, so this is a credible but conditional priority requiring valid customer credentials and an administrator to browse the affected view.
Stored cross-site scripting in Froxlor 2.0.0 through 2.3.10 lets an authenticated customer - the lowest-privileged account role - inject JavaScript through the issuer organization field of an SSL certificate they upload for their own domain, which is parsed by openssl_x509_parse() and stored verbatim without sanitization. The payload executes only when a reseller or administrator opens Domains > SSL certificates, because the table-listing renderer passes scalar cells through Twig's raw filter and disables HTML auto-escaping, so the script runs in the privileged user's session and can result in full administrator account takeover. Because a Froxlor admin controls webserver, DNS and PHP configuration applied by a root cron job, that takeover can be escalated to command execution as root on the managed server. No public exploit identified at time of analysis; exploitation requires a valid tenant account plus privileged-user page interaction (UI:P), which makes this a genuine priority within its deployment niche rather than a mass-exploitation emergency.
Authenticated API users in Froxlor before 2.3.12 can retrieve bcrypt password hashes for htpasswd-protected directories via the DirProtections.listing API command, enabling offline cracking and potential exposure of reused credentials. This credential disclosure affects installations that have configured protected directories; if none exist, no hashes are exposed. No public exploit identified at time of analysis, and the impact is confidentiality-only, limited by bcrypt's cost.
Froxlor through 2.3.10 fails to enforce the mail.allow_external_domains policy in the EmailSender.add API command, letting an authenticated customer with API access register an arbitrary external sender address for their mailbox even when the administrator has explicitly disabled external allowed-sender domains. The bypass only matters when the administrator has enabled the allowed-sender feature (mail.enable_allow_sender=1) while disabling external domains (mail.allow_external_domains=0), and the sender-spoofing impact materializes only if the generated mail configuration consumes the allowed-sender table; there is no public exploit identified at time of analysis, and exploitation requires valid low-privilege API credentials rather than being unauthenticated. A vendor-released patch is available in Froxlor 2.3.12, and our independent assessment rates this as a genuine but modest-severity authorization/policy-enforcement flaw rather than a high-urgency one.
Authenticated low-privilege Froxlor users with subdomain-create rights can inject arbitrary nginx or Apache configuration directives via CRLF sequences in the userinfo component of a subdomain redirect URL, leading to server-wide response hijacking and local file disclosure. The vulnerability affects versions 0 through 2.3.10 (incompletely fixed) and up to version 2.3.12, which contains the complete fix. The independent assessment rates this as a genuine high-priority vulnerability; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in the Froxlor server administration panel (2.3.10 and earlier, including any build carrying only the earlier incomplete GHSA fix) lets an authenticated customer account with the data-export/DataDump feature enabled take ownership of arbitrary host directories, including /etc and other tenants' trees. The root-owned export cron runs `chown -R` through a symlink the customer plants at an intermediate path component of their export destination, because Froxlor\FileDir::makeCorrectDir() has an off-by-one in its path-component walk that skips the first segment below the customer home directory and ExportCron.php only validates the final component with is_link(). Exploitation is deterministic and needs no race, resulting in host root and cross-tenant compromise; the flaw is fixed in Froxlor 2.3.12, and no public exploit was identified at time of analysis.
Arbitrary file deletion in Froxlor through 2.3.10 lets an authenticated customer account with write access to an FTP home directory plant a symlink that a root cron job later follows, recursively deleting arbitrary directory trees. The flaw is a TOCTOU race: the deleteFtpData cron task (task 8) runs FileDir::makeCorrectDir() without the $fixed_homedir argument, skipping symlink validation before executing 'rm -rf' as root on a trailing-slash path that GNU rm dereferences. Exploitation requires valid low-privilege credentials and winning the timing window between task insertion and cron execution; no public exploit identified at time of analysis. Impact is deletion-only but can cross tenant boundaries and cause host denial of service on multi-tenant hosting deployments.
Argument injection in the Froxlor hosting control panel (versions before 2.3.12) allows an authenticated administrator - or any actor able to write settings, such as through the settings-import API - to inject arbitrary acme.sh command-line options via the unescaped system.letsencryptchallengepath setting, resulting in arbitrary command execution as root the next time the Let's Encrypt cron job runs. The vendor CVSS 4.0 score of 9.4 (and the independently assessed CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of the host, but exploitation is gated behind a high-privilege settings-write primitive (PR:H) and requires that acme.sh-based Let's Encrypt certificate issuance be configured so the root cron actually executes the poisoned command line. No public exploit code was identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); the vendor-released fix is Froxlor 2.3.12.
Local privilege escalation to full root compromise on Froxlor panel hosts (2.3.10 and earlier) is achievable by an authenticated Froxlor customer holding a shell account, but only where the non-default setting system.allow_customer_shell=1 is enabled, which is a prerequisite for the attack to be reachable at all. The attacker wins a TOCTOU race in the root-run SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles) by atomically swapping their ~/.ssh directory for a symlink in the window between FileDir::makeCorrectDir()/makeCorrectFile() validation and the root-privileged file_put_contents/chown, causing the customer's public key to be appended to /root/.ssh/authorized_keys and /root/.ssh to be chowned to the customer; the cron re-runs every interval, so attempts are effectively unlimited until the race lands. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; it is a genuine root-compromise primitive but tightly gated by the non-default shell setting and by race timing, making it a moderate real-world priority rather than an emergency. The issue is fixed in Froxlor 2.3.12.
Cross-site request forgery in the Froxlor hosting control panel through 2.3.10 lets an unauthenticated attacker silently strip a logged-in panel user's two-factor authentication by luring them into following a crafted GET link such as /customer_index.php?page=2fa&action=delete, with no confirmation prompt, re-authentication, or CSRF token required; both the customer and admin 2FA handlers are affected. The practical impact is bounded: the attack only removes the second factor, and full account takeover additionally requires the victim's password to already be compromised, so this is a genuine but modest-severity CSRF rather than a standalone authentication bypass. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor addressed the flaw in Froxlor 2.3.12.
Froxlor hosting control panels before 2.3.12 do not invalidate existing panel sessions, issued API keys, or 2FA 'trust this device' cookies when an account password is changed, so an attacker who already holds one of those authentication artifacts keeps full access to the account even after the victim rotates their password as an incident-response measure. The flaw is a post-compromise persistence issue: it requires a separate, prior theft of a session cookie, API key, or 2FA trust token, making the CVSS 4.0 base score of 8.7 and its AC:L/PR:N framing an overstatement of real-world risk; our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with impact scope depending on whether the affected account is a customer or an admin/reseller. No public exploit code has been identified and the issue is not confirmed actively exploited (not in CISA KEV). A vendor-released patch is available in version 2.3.12.
Second-factor bypass in Froxlor through 2.3.10 allows an attacker who already knows a target administrator's password to defeat the administrator's TOTP protection and obtain a full authenticated admin session. The flaw is rooted in remembered-2FA tokens (panel_2fa_tokens) storing only a bare numeric user ID with no account-type namespace; because customer and administrator IDs are drawn from separate sequences, a remembered-2FA cookie issued to a customer can satisfy the login-time token lookup for an administrator with the same numeric ID, which is not constrained by account type. Exploitation is chained and targeted: it requires prior password compromise, control of a customer account whose ID collides with the target admin, and a live remembered-2FA cookie, so this is not a default-config remote takeover; no public exploit code was identified at time of analysis, and the issue is fixed in 2.3.12 (per the CVSS 4.0 vector, PR:L).
Private TLS keys stored by Froxlor before 2.3.13 are disclosed verbatim through the Certificates.get and Certificates.listing API commands, letting any authenticated API caller - including the lowest-privilege customer account - read the raw PEM private keys of their own domains, such as server-generated Let's Encrypt keys normally stored root-only (0600) and inaccessible to that customer, while a reseller account or an admin with the customers_see_all flag can pull other principals' keys through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks. The independently assessed vector (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects high confidentiality impact with cross-tenant scope but no direct integrity or availability loss, and no public exploit identified at time of analysis.
Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. This is a CWE-93 CRLF/newline-injection flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SSH key injection in Froxlor before 2.3.12 allows authenticated customers to write arbitrary lines into server-side authorized_keys files by embedding newline characters in SSH public key submissions to the SshKeys::add() API endpoint. An attacker with a valid customer account can plant SSH key entries bearing OpenSSH option directives (e.g., command=, from=, restrict) that persist beyond explicit key-deletion and access-revocation actions performed by administrators. No public exploit has been identified at time of analysis, but the vendor advisory confirms the flaw and the fix version.
Symlink-based privilege escalation in Froxlor versions prior to 2.3.6 allows authenticated customers to gain ownership of arbitrary system directories. When the ExportCron executes as root, it performs 'chown -R' on user-controlled export paths that bypass symlink validation (introduced to fix CVE-2023-6069), enabling attackers to place symbolic links and hijack ownership of critical system files. This is a regression of the CVE-2023-6069 fix where DataDump.add() failed to apply the same symlink protections used elsewhere. EPSS data unavailable; no evidence of active exploitation (not in CISA KEV), but the specific vulnerability class (symlink following in privileged operations) has well-known exploitation patterns. Patch available in version 2.3.6.
DNS zone file injection in Froxlor versions prior to 2.3.6 allows authenticated customers to inject arbitrary BIND directives and DNS records through unvalidated record types and unsanitized newline characters. Attackers with low-privilege customer accounts can manipulate DNS resolution for managed domains by embedding malicious directives like $INCLUDE, $ORIGIN, or $GENERATE into zone files, potentially redirecting traffic, creating unauthorized records, or disrupting DNS services. CVSS 8.5 with scope change indicates impact beyond the vulnerable component. Vendor patch released in version 2.3.6 (GitHub commit 47a8af5d). No CISA KEV listing or public exploit identified at time of analysis, but attack complexity is low (AC:L) for authenticated users.
Remote code execution in Froxlor server administration software versions prior to 2.3.6 allows authenticated administrators with change_serversettings permission to inject arbitrary PHP code through an unescaped MySQL server configuration parameter. The vulnerability enables persistent code execution on every subsequent HTTP request as the web server user due to improper input sanitization in PhpHelper::parseArrayToString(). Vendor patch available in version 2.3.6. CVSS score of 9.1 reflects the critical impact despite requiring high-privilege authentication, with scope change indicating the attacker can break out of the application's security context.
Authenticated customers can achieve remote code execution in Froxlor server administration software versions prior to 2.3.6 through path traversal in the API's language parameter. By injecting malicious path traversal sequences into the `def_language` field via the `Customers.update` or `Admins.update` API endpoints, authenticated users can force the application to execute arbitrary PHP code as the web server user on subsequent requests. This vulnerability carries a CVSS score of 9.9 with scope change, indicating potential for full system compromise beyond the vulnerable component. Vendor-released patch version 2.3.6 addresses the vulnerability by implementing proper validation of language parameters against available language files.
Command injection in Froxlor server admin before 2.3.4 due to typo (== instead of =) disabling input validation entirely. PoC and patch available.
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Froxlor 0.10.0 through 2.3.14 does not enforce the main-domain deletion restriction in the SubDomains.delete API command, allowing any authenticated customer to delete a reseller- or admin-provisioned main domain by supplying its id. This can orphan vhost, DNS, and subdomain records and push subdomains_used below zero, granting extra subdomain allowance. The vendor fixed the missing authorization check in 2.3.15; no public exploit was identified at time of analysis.
An authorization bypass in the Froxlor hosting control panel (versions 0.10.0 through 2.3.14) lets an authenticated reseller read any administrator's full account record through the Admins.get API command by pairing their own loginname with another admin's numeric id. The flaw is an OR-based identity check in lib/Froxlor/Api/Commands/Admins.php: a mismatched id/loginname pair still passed the privilege gate, while the subsequent database query was driven by the numeric id alone, exposing contact email addresses, IP allow-lists, resource limits, internal notes, and login history for arbitrary admins. Impact is read-only information disclosure of administrator metadata from a low-privileged account (no modification is possible), no public exploit code was identified at time of analysis, and the issue is fixed in Froxlor 2.3.15.
Froxlor versions before 2.3.14 expose the full contents of other administrators' email templates to authenticated reseller admins through an insecure direct object reference in the email template editor (admin_templates.php). A reseller admin supplies their own subjectid while substituting a sequential, foreign mailbodyid in an edit request, and the application returns the mail body without verifying that the requester owns the referenced record. Rated CVSS 5.3 (v4.0) and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, this is a moderate authorization-boundary issue: there is no public exploit identified at time of analysis, no write or code-execution capability, and it yields nothing in single-admin deployments where no other tenants' templates exist.
Froxlor 0.10.0 before 2.3.14 leaks full-admin-only MySQL server and cronjob configuration metadata to authenticated reseller accounts through the MysqlServer.listing, MysqlServer.get, and Cronjobs.listing API read commands in api.php. The missing authorization check (CWE-285) requires an authenticated reseller-level account on a multi-tenant instance with API access enabled, and impact is limited to read-only disclosure of management usernames, hosts, ports, TLS settings, and cron metadata with no write or code-execution capability. No public exploit identified at time of analysis, and the issue is assessed as modest-severity information disclosure rather than a top-tier priority.
Froxlor through 2.3.10 exposes DKIM private signing keys through its customer-facing API: the Domains.get, Domains.listing, SubDomains.get, and admin SubDomains.listing methods run an unfiltered wildcard SELECT over the panel_domains table and return the dkim_privkey column verbatim to the caller. An authenticated admin who is not a superadmin but has been granted the delegated customers_see_all flag can retrieve the DKIM private keys of every domain visible to them across tenants, and a single listing call discloses the keys for all such domains. Compromising those keys lets the holder forge DKIM signatures that pass DKIM verification and DMARC alignment for the affected domains; the issue is a follow-on to an earlier incomplete fix that scrubbed password and data_2fa but left dkim_privkey in the response. There is no public exploit identified at time of analysis, and the risk is real but bounded because it requires a high-privilege delegated admin role in a multi-tenant deployment; the vendor has released the fix in 2.3.12.
Froxlor versions prior to 2.3.6 allow authenticated resellers to bypass domain quota restrictions by attributing newly created domains to arbitrary admins through unvalidated `adminid` parameter input in the `Domains.add()` function. This vulnerability enables quota exhaustion attacks against other administrators and domain creation beyond the attacker's assigned limits, with confirmed patch availability in version 2.3.6.
Froxlor versions prior to 2.3.6 fail to validate domain ownership correctly when adding full email sender aliases, allowing authenticated customers to add sender aliases for email addresses on domains belonging to other customers and subsequently send emails as those addresses via Postfix sender_login_maps authorization. The vulnerability stems from an array indexing error in EmailSender::add() that passes the local part of an email address instead of the domain to the ownership validation function, causing the check to pass for non-existent domains. No active exploitation has been confirmed at the time of analysis.
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.
Froxlor is open-source server administration software. Rated medium severity (CVSS 5.8), this vulnerability is low attack complexity. Public exploit code available.
Froxlor is open source server administration software. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Froxlor through 0.10.15. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in Froxlor before 0.10.14. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity.
An issue was discovered in Froxlor before 0.10.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Froxlor before 2.3.15 allows an authenticated hosting customer with write access to their document root to escalate to root by replacing the statistics directory with a symlink, so the root-run traffic cron's recursive chown follows the link and changes ownership of arbitrary host directories. Exploitation requires a valid customer account, enabled goaccess/webalizer/awstats statistics, and execution of the scheduled traffic cron; no public exploit identified at time of analysis. Vendor-released patch: 2.3.15.
Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.
Stored cross-site scripting in Froxlor 2.0.0 before 2.3.14 allows an authenticated customer to inject HTML/JavaScript through a theme value set in customer_index.php; the payload only executes when an administrator later views the customer overview with the Theme column enabled. Successful exploitation can abuse the administrator's CSRF token to create administrator accounts or change server settings. No public exploit code or CISA KEV listing is identified in the available data, so this is a credible but conditional priority requiring valid customer credentials and an administrator to browse the affected view.
Stored cross-site scripting in Froxlor 2.0.0 through 2.3.10 lets an authenticated customer - the lowest-privileged account role - inject JavaScript through the issuer organization field of an SSL certificate they upload for their own domain, which is parsed by openssl_x509_parse() and stored verbatim without sanitization. The payload executes only when a reseller or administrator opens Domains > SSL certificates, because the table-listing renderer passes scalar cells through Twig's raw filter and disables HTML auto-escaping, so the script runs in the privileged user's session and can result in full administrator account takeover. Because a Froxlor admin controls webserver, DNS and PHP configuration applied by a root cron job, that takeover can be escalated to command execution as root on the managed server. No public exploit identified at time of analysis; exploitation requires a valid tenant account plus privileged-user page interaction (UI:P), which makes this a genuine priority within its deployment niche rather than a mass-exploitation emergency.
Authenticated API users in Froxlor before 2.3.12 can retrieve bcrypt password hashes for htpasswd-protected directories via the DirProtections.listing API command, enabling offline cracking and potential exposure of reused credentials. This credential disclosure affects installations that have configured protected directories; if none exist, no hashes are exposed. No public exploit identified at time of analysis, and the impact is confidentiality-only, limited by bcrypt's cost.
Froxlor through 2.3.10 fails to enforce the mail.allow_external_domains policy in the EmailSender.add API command, letting an authenticated customer with API access register an arbitrary external sender address for their mailbox even when the administrator has explicitly disabled external allowed-sender domains. The bypass only matters when the administrator has enabled the allowed-sender feature (mail.enable_allow_sender=1) while disabling external domains (mail.allow_external_domains=0), and the sender-spoofing impact materializes only if the generated mail configuration consumes the allowed-sender table; there is no public exploit identified at time of analysis, and exploitation requires valid low-privilege API credentials rather than being unauthenticated. A vendor-released patch is available in Froxlor 2.3.12, and our independent assessment rates this as a genuine but modest-severity authorization/policy-enforcement flaw rather than a high-urgency one.
Authenticated low-privilege Froxlor users with subdomain-create rights can inject arbitrary nginx or Apache configuration directives via CRLF sequences in the userinfo component of a subdomain redirect URL, leading to server-wide response hijacking and local file disclosure. The vulnerability affects versions 0 through 2.3.10 (incompletely fixed) and up to version 2.3.12, which contains the complete fix. The independent assessment rates this as a genuine high-priority vulnerability; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in the Froxlor server administration panel (2.3.10 and earlier, including any build carrying only the earlier incomplete GHSA fix) lets an authenticated customer account with the data-export/DataDump feature enabled take ownership of arbitrary host directories, including /etc and other tenants' trees. The root-owned export cron runs `chown -R` through a symlink the customer plants at an intermediate path component of their export destination, because Froxlor\FileDir::makeCorrectDir() has an off-by-one in its path-component walk that skips the first segment below the customer home directory and ExportCron.php only validates the final component with is_link(). Exploitation is deterministic and needs no race, resulting in host root and cross-tenant compromise; the flaw is fixed in Froxlor 2.3.12, and no public exploit was identified at time of analysis.
Arbitrary file deletion in Froxlor through 2.3.10 lets an authenticated customer account with write access to an FTP home directory plant a symlink that a root cron job later follows, recursively deleting arbitrary directory trees. The flaw is a TOCTOU race: the deleteFtpData cron task (task 8) runs FileDir::makeCorrectDir() without the $fixed_homedir argument, skipping symlink validation before executing 'rm -rf' as root on a trailing-slash path that GNU rm dereferences. Exploitation requires valid low-privilege credentials and winning the timing window between task insertion and cron execution; no public exploit identified at time of analysis. Impact is deletion-only but can cross tenant boundaries and cause host denial of service on multi-tenant hosting deployments.
Argument injection in the Froxlor hosting control panel (versions before 2.3.12) allows an authenticated administrator - or any actor able to write settings, such as through the settings-import API - to inject arbitrary acme.sh command-line options via the unescaped system.letsencryptchallengepath setting, resulting in arbitrary command execution as root the next time the Let's Encrypt cron job runs. The vendor CVSS 4.0 score of 9.4 (and the independently assessed CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of the host, but exploitation is gated behind a high-privilege settings-write primitive (PR:H) and requires that acme.sh-based Let's Encrypt certificate issuance be configured so the root cron actually executes the poisoned command line. No public exploit code was identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); the vendor-released fix is Froxlor 2.3.12.
Local privilege escalation to full root compromise on Froxlor panel hosts (2.3.10 and earlier) is achievable by an authenticated Froxlor customer holding a shell account, but only where the non-default setting system.allow_customer_shell=1 is enabled, which is a prerequisite for the attack to be reachable at all. The attacker wins a TOCTOU race in the root-run SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles) by atomically swapping their ~/.ssh directory for a symlink in the window between FileDir::makeCorrectDir()/makeCorrectFile() validation and the root-privileged file_put_contents/chown, causing the customer's public key to be appended to /root/.ssh/authorized_keys and /root/.ssh to be chowned to the customer; the cron re-runs every interval, so attempts are effectively unlimited until the race lands. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; it is a genuine root-compromise primitive but tightly gated by the non-default shell setting and by race timing, making it a moderate real-world priority rather than an emergency. The issue is fixed in Froxlor 2.3.12.
Cross-site request forgery in the Froxlor hosting control panel through 2.3.10 lets an unauthenticated attacker silently strip a logged-in panel user's two-factor authentication by luring them into following a crafted GET link such as /customer_index.php?page=2fa&action=delete, with no confirmation prompt, re-authentication, or CSRF token required; both the customer and admin 2FA handlers are affected. The practical impact is bounded: the attack only removes the second factor, and full account takeover additionally requires the victim's password to already be compromised, so this is a genuine but modest-severity CSRF rather than a standalone authentication bypass. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor addressed the flaw in Froxlor 2.3.12.
Froxlor hosting control panels before 2.3.12 do not invalidate existing panel sessions, issued API keys, or 2FA 'trust this device' cookies when an account password is changed, so an attacker who already holds one of those authentication artifacts keeps full access to the account even after the victim rotates their password as an incident-response measure. The flaw is a post-compromise persistence issue: it requires a separate, prior theft of a session cookie, API key, or 2FA trust token, making the CVSS 4.0 base score of 8.7 and its AC:L/PR:N framing an overstatement of real-world risk; our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with impact scope depending on whether the affected account is a customer or an admin/reseller. No public exploit code has been identified and the issue is not confirmed actively exploited (not in CISA KEV). A vendor-released patch is available in version 2.3.12.
Second-factor bypass in Froxlor through 2.3.10 allows an attacker who already knows a target administrator's password to defeat the administrator's TOTP protection and obtain a full authenticated admin session. The flaw is rooted in remembered-2FA tokens (panel_2fa_tokens) storing only a bare numeric user ID with no account-type namespace; because customer and administrator IDs are drawn from separate sequences, a remembered-2FA cookie issued to a customer can satisfy the login-time token lookup for an administrator with the same numeric ID, which is not constrained by account type. Exploitation is chained and targeted: it requires prior password compromise, control of a customer account whose ID collides with the target admin, and a live remembered-2FA cookie, so this is not a default-config remote takeover; no public exploit code was identified at time of analysis, and the issue is fixed in 2.3.12 (per the CVSS 4.0 vector, PR:L).
Private TLS keys stored by Froxlor before 2.3.13 are disclosed verbatim through the Certificates.get and Certificates.listing API commands, letting any authenticated API caller - including the lowest-privilege customer account - read the raw PEM private keys of their own domains, such as server-generated Let's Encrypt keys normally stored root-only (0600) and inaccessible to that customer, while a reseller account or an admin with the customers_see_all flag can pull other principals' keys through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks. The independently assessed vector (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects high confidentiality impact with cross-tenant scope but no direct integrity or availability loss, and no public exploit identified at time of analysis.
Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. This is a CWE-93 CRLF/newline-injection flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SSH key injection in Froxlor before 2.3.12 allows authenticated customers to write arbitrary lines into server-side authorized_keys files by embedding newline characters in SSH public key submissions to the SshKeys::add() API endpoint. An attacker with a valid customer account can plant SSH key entries bearing OpenSSH option directives (e.g., command=, from=, restrict) that persist beyond explicit key-deletion and access-revocation actions performed by administrators. No public exploit has been identified at time of analysis, but the vendor advisory confirms the flaw and the fix version.
Symlink-based privilege escalation in Froxlor versions prior to 2.3.6 allows authenticated customers to gain ownership of arbitrary system directories. When the ExportCron executes as root, it performs 'chown -R' on user-controlled export paths that bypass symlink validation (introduced to fix CVE-2023-6069), enabling attackers to place symbolic links and hijack ownership of critical system files. This is a regression of the CVE-2023-6069 fix where DataDump.add() failed to apply the same symlink protections used elsewhere. EPSS data unavailable; no evidence of active exploitation (not in CISA KEV), but the specific vulnerability class (symlink following in privileged operations) has well-known exploitation patterns. Patch available in version 2.3.6.
DNS zone file injection in Froxlor versions prior to 2.3.6 allows authenticated customers to inject arbitrary BIND directives and DNS records through unvalidated record types and unsanitized newline characters. Attackers with low-privilege customer accounts can manipulate DNS resolution for managed domains by embedding malicious directives like $INCLUDE, $ORIGIN, or $GENERATE into zone files, potentially redirecting traffic, creating unauthorized records, or disrupting DNS services. CVSS 8.5 with scope change indicates impact beyond the vulnerable component. Vendor patch released in version 2.3.6 (GitHub commit 47a8af5d). No CISA KEV listing or public exploit identified at time of analysis, but attack complexity is low (AC:L) for authenticated users.
Remote code execution in Froxlor server administration software versions prior to 2.3.6 allows authenticated administrators with change_serversettings permission to inject arbitrary PHP code through an unescaped MySQL server configuration parameter. The vulnerability enables persistent code execution on every subsequent HTTP request as the web server user due to improper input sanitization in PhpHelper::parseArrayToString(). Vendor patch available in version 2.3.6. CVSS score of 9.1 reflects the critical impact despite requiring high-privilege authentication, with scope change indicating the attacker can break out of the application's security context.
Authenticated customers can achieve remote code execution in Froxlor server administration software versions prior to 2.3.6 through path traversal in the API's language parameter. By injecting malicious path traversal sequences into the `def_language` field via the `Customers.update` or `Admins.update` API endpoints, authenticated users can force the application to execute arbitrary PHP code as the web server user on subsequent requests. This vulnerability carries a CVSS score of 9.9 with scope change, indicating potential for full system compromise beyond the vulnerable component. Vendor-released patch version 2.3.6 addresses the vulnerability by implementing proper validation of language parameters against available language files.
Command injection in Froxlor server admin before 2.3.4 due to typo (== instead of =) disabling input validation entirely. PoC and patch available.
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Froxlor 0.10.0 through 2.3.14 does not enforce the main-domain deletion restriction in the SubDomains.delete API command, allowing any authenticated customer to delete a reseller- or admin-provisioned main domain by supplying its id. This can orphan vhost, DNS, and subdomain records and push subdomains_used below zero, granting extra subdomain allowance. The vendor fixed the missing authorization check in 2.3.15; no public exploit was identified at time of analysis.
An authorization bypass in the Froxlor hosting control panel (versions 0.10.0 through 2.3.14) lets an authenticated reseller read any administrator's full account record through the Admins.get API command by pairing their own loginname with another admin's numeric id. The flaw is an OR-based identity check in lib/Froxlor/Api/Commands/Admins.php: a mismatched id/loginname pair still passed the privilege gate, while the subsequent database query was driven by the numeric id alone, exposing contact email addresses, IP allow-lists, resource limits, internal notes, and login history for arbitrary admins. Impact is read-only information disclosure of administrator metadata from a low-privileged account (no modification is possible), no public exploit code was identified at time of analysis, and the issue is fixed in Froxlor 2.3.15.
Froxlor versions before 2.3.14 expose the full contents of other administrators' email templates to authenticated reseller admins through an insecure direct object reference in the email template editor (admin_templates.php). A reseller admin supplies their own subjectid while substituting a sequential, foreign mailbodyid in an edit request, and the application returns the mail body without verifying that the requester owns the referenced record. Rated CVSS 5.3 (v4.0) and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, this is a moderate authorization-boundary issue: there is no public exploit identified at time of analysis, no write or code-execution capability, and it yields nothing in single-admin deployments where no other tenants' templates exist.
Froxlor 0.10.0 before 2.3.14 leaks full-admin-only MySQL server and cronjob configuration metadata to authenticated reseller accounts through the MysqlServer.listing, MysqlServer.get, and Cronjobs.listing API read commands in api.php. The missing authorization check (CWE-285) requires an authenticated reseller-level account on a multi-tenant instance with API access enabled, and impact is limited to read-only disclosure of management usernames, hosts, ports, TLS settings, and cron metadata with no write or code-execution capability. No public exploit identified at time of analysis, and the issue is assessed as modest-severity information disclosure rather than a top-tier priority.
Froxlor through 2.3.10 exposes DKIM private signing keys through its customer-facing API: the Domains.get, Domains.listing, SubDomains.get, and admin SubDomains.listing methods run an unfiltered wildcard SELECT over the panel_domains table and return the dkim_privkey column verbatim to the caller. An authenticated admin who is not a superadmin but has been granted the delegated customers_see_all flag can retrieve the DKIM private keys of every domain visible to them across tenants, and a single listing call discloses the keys for all such domains. Compromising those keys lets the holder forge DKIM signatures that pass DKIM verification and DMARC alignment for the affected domains; the issue is a follow-on to an earlier incomplete fix that scrubbed password and data_2fa but left dkim_privkey in the response. There is no public exploit identified at time of analysis, and the risk is real but bounded because it requires a high-privilege delegated admin role in a multi-tenant deployment; the vendor has released the fix in 2.3.12.
Froxlor versions prior to 2.3.6 allow authenticated resellers to bypass domain quota restrictions by attributing newly created domains to arbitrary admins through unvalidated `adminid` parameter input in the `Domains.add()` function. This vulnerability enables quota exhaustion attacks against other administrators and domain creation beyond the attacker's assigned limits, with confirmed patch availability in version 2.3.6.
Froxlor versions prior to 2.3.6 fail to validate domain ownership correctly when adding full email sender aliases, allowing authenticated customers to add sender aliases for email addresses on domains belonging to other customers and subsequently send emails as those addresses via Postfix sender_login_maps authorization. The vulnerability stems from an array indexing error in EmailSender::add() that passes the local part of an email address instead of the domain to the ownership validation function, causing the check to pass for non-existent domains. No active exploitation has been confirmed at the time of analysis.
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.
Froxlor is open-source server administration software. Rated medium severity (CVSS 5.8), this vulnerability is low attack complexity. Public exploit code available.
Froxlor is open source server administration software. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Froxlor through 0.10.15. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in Froxlor before 0.10.14. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity.
An issue was discovered in Froxlor before 0.10.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.