p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости froxlor/froxlor · Страница 2

За последние 30 дней в froxlor/froxlor опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 60

  1. CVE-2026-26279

    Критический · CVSS 9.1EPSS 0,85%Есть исправление

    Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

    Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.

    froxlor/froxlorPHP
    • Обновитесь до 2.3.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2025-48958

    Средний · CVSS 5.5EPSS 0,34%Есть исправление

    Froxlor has an HTML Injection Vulnerability

    Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.

    froxlor/froxlorPHP
    • Обновитесь до 2.2.6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2025-29773

    Средний · CVSS 5.8EPSS 0,29%Есть исправление

    Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

    Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin. The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and s

    froxlor/froxlorPHP
    • Обновитесь до 2.2.6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2024-34070

    Критический · CVSS 9.7EPSS 0,97%Есть исправление

    Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise

    Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administr

    froxlor/froxlorPHP
    • Обновитесь до 2.1.9
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2023-50256

    Высокий · CVSS 7.5EPSS 0,72%Есть исправление

    Froxlor username/surname AND company field Bypass

    Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.

    froxlor/froxlorPHP
    • Обновитесь до 2.1.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2023-6069

    Критический · CVSS 9.9EPSS 0,83%Есть исправление

    Improper Link Resolution Before File Access in froxlor/froxlor

    Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.

    froxlor/froxlorPHP
    • Обновитесь до 2.1.0-beta1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2023-3173

    Критический · CVSS 9.8EPSS 1,13%Есть исправление

    Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor

    Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.

    froxlor/froxlorPHP
    • Обновитесь до 2.0.20
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2023-2666

    Средний · CVSS 6.8EPSS 0,68%Есть исправление

    Allocation of Resources Without Limits or Throttling in froxlor/froxlor

    Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.

    froxlor/froxlorPHP
    • Обновитесь до 2.0.16
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2023-2034

    Критический · CVSS 9.1EPSS 71,43%Есть исправление

    Unrestricted Upload of File with Dangerous Type in froxlor/froxlor

    Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.

    froxlor/froxlorPHP
    • Обновитесь до 2.0.14
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →