Vulnerabilidades em froxlor

77 resultados
Análise Vexday

Froxlor apresenta 41 vulnerabilidades catalogadas, com 11 em nível crítico e 10 divulgadas nos últimos 90 dias, indicando cadência preocupante de descobertas recentes. A fraqueza dominante é XSS (CWE-79), típica de aplicações web, mas nenhuma vulnerabilidade está em exploração ativa conhecida no momento. O volume recente de críticas demanda atenção prioritária em ciclos de atualização.

CVE-2026-62988CRITICALFroxlor: Credential and 2FA secret disclosure via Froxlor API endpointsEPSS 0.6%CVE-2023-4304LOWBusiness Logic Errors in froxlor/froxlorEPSS 0.6%CVE-2026-30932HIGHFroxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIEPSS 0.6%CVE-2023-0565MEDIUMBusiness Logic Errors in froxlor/froxlorEPSS 0.6%CVE-2026-100714CRITICALFroxlor before 2.3.12 Command Injection via letsencryptchallengepathEPSS 0.5%CVE-2026-41228CRITICALFroxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code ExecutionEPSS 0.5%CVE-2022-4864MEDIUM Argument Injection in froxlor/froxlorEPSS 0.5%CVE-2026-41229CRITICALFroxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)EPSS 0.5%CVE-2026-100716CRITICALFroxlor before 2.3.12 Privilege Escalation via SymlinkEPSS 0.5%CVE-2026-100715HIGHFroxlor before 2.3.12 Arbitrary File Deletion via SymlinkEPSS 0.5%CVE-2023-0564MEDIUMWeak Password Requirements in froxlor/froxlorEPSS 0.5%CVE-2026-90937CRITICALfroxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLEPSS 0.5%CVE-2026-113677MEDIUMFroxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete APIEPSS 0.4%CVE-2026-54543MEDIUMFroxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsEPSS 0.4%CVE-2026-121436HIGHFroxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpEPSS 0.4%CVE-2023-4829MEDIUMCross-site Scripting (XSS) - Stored in froxlor/froxlorEPSS 0.4%CVE-2023-0566MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlorEPSS 0.4%CVE-2022-3017MEDIUMCross-Site Request Forgery (CSRF) in froxlor/froxlorEPSS 0.4%CVE-2026-90767HIGHFroxlor before 2.3.12 SSH Key Injection via authorized_keysEPSS 0.4%CVE-2023-3192MEDIUMSession Fixation in froxlor/froxlorEPSS 0.4%