Vulnerabilities in Froxlor
54 resultsVexday analysis
Froxlor apresenta um perfil de risco baixo com apenas 2 vulnerabilidades registradas na base, nenhuma delas em exploração ativa ou crítica. A fraqueza dominante é relacionada a validação inadequada de entrada (CWE-20), mas sem evidência de atividade recente de ataque ou novas publicações nos últimos 90 dias.
CVE-2026-54348HIGHFroxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationEPSS 0.7%CVE-2022-4868MEDIUMImproper Authorization in froxlor/froxlorEPSS 0.6%CVE-2026-62988CRITICALFroxlor: Credential and 2FA secret disclosure via Froxlor API endpointsEPSS 0.6%CVE-2023-4304LOWBusiness Logic Errors in froxlor/froxlorEPSS 0.6%CVE-2026-41236HIGHFroxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` pathEPSS 0.6%CVE-2023-0565MEDIUMBusiness Logic Errors in froxlor/froxlorEPSS 0.6%CVE-2026-41230HIGHFroxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()EPSS 0.5%CVE-2026-41231HIGHFroxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via CronEPSS 0.5%CVE-2022-4864MEDIUM Argument Injection in froxlor/froxlorEPSS 0.5%CVE-2026-41237HIGHFroxlor has an incomplete fix for CVE-2026-30932EPSS 0.5%CVE-2026-41234HIGHFroxlor: BIND Zone File Injection via TXT Record ContentEPSS 0.5%CVE-2023-0564MEDIUMWeak Password Requirements in froxlor/froxlorEPSS 0.5%CVE-2026-90937CRITICALfroxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLEPSS 0.5%CVE-2026-54543MEDIUMFroxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsEPSS 0.4%CVE-2023-0566MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlorEPSS 0.4%CVE-2026-90767HIGHFroxlor before 2.3.12 SSH Key Injection via authorized_keysEPSS 0.4%CVE-2023-3192MEDIUMSession Fixation in froxlor/froxlorEPSS 0.4%CVE-2022-3017MEDIUMCross-Site Request Forgery (CSRF) in froxlor/froxlorEPSS 0.4%CVE-2026-54347HIGHFroxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account TakeoverEPSS 0.4%CVE-2026-41233MEDIUMFroxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()EPSS 0.4%