Security
فارسی
All products

froxlor/froxlor

Composer · Package
60 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Froxlor: Authenticated customers can read other customers' allowed sender aliasesCVE-2026-90936 · GHSA-MR9H-45P9-FG8H froxlor/froxlor Composer Medium Fix reported
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add APICVE-2026-90935 · GHSA-Q4RM-M6XH-5PV7 froxlor/froxlor Composer Medium Fix reported
Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>CVE-2024-58383 · GHSA-34QG-65M4-F23M froxlor/froxlor Composer High Fix reported
Froxlor: BIND Zone File Injection via TXT Record ContentCVE-2026-41234 · GHSA-37M5-M4Q3-FC6X froxlor/froxlor Composer High Fix reported
Froxlor has an incomplete fix for CVE-2026-30932CVE-2026-41237 · GHSA-J6FM-9RFM-J5HX froxlor/froxlor Composer High Fix reported
Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` pathCVE-2026-41236 · GHSA-MQ5V-PXPM-8JW2 froxlor/froxlor Composer High Fix reported
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcementCVE-2026-41235 · GHSA-GCV3-5V9Q-FMHH froxlor/froxlor Composer High Fix reported
Froxlor's API Authentication bypasses 2FA AuthenticationCVE-2026-52793 · GHSA-F9RX-7WF7-JR36 froxlor/froxlor Composer High Fix reported
Blind XSS Leading to Froxlor Application CompromiseCVE-2024-34070 · GHSA-X525-54HF-XR53 froxlor/froxlor Composer Critical Fix reported
Froxlor has an HTML Injection VulnerabilityCVE-2025-48958 · GHSA-26XQ-M8XW-6373 froxlor/froxlor Composer Medium Fix reported
Froxlor username/surname AND company field BypassCVE-2023-50256 · GHSA-625G-FM5W-W7W4 froxlor/froxlor Composer High Fix reported
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account TakeoverCVE-2025-29773 · GHSA-7J6W-P859-464F froxlor/froxlor Composer Medium Fix reported
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsCVE-2026-54543 · GHSA-5RW4-4665-CVWF froxlor/froxlor Composer Medium Fix reported
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationCVE-2026-54348 · GHSA-W27M-RMMF-G5W4 froxlor/froxlor Composer High Fix reported
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account TakeoverCVE-2026-54347 · GHSA-43GM-9RR3-CX7G froxlor/froxlor Composer High Fix reported
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpointsCVE-2026-62988 · GHSA-7788-GHFQ-C6MH froxlor/froxlor Composer Critical Fix reported
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery ProtectionCVE-2026-55593 · GHSA-XPR4-8VP6-C87J froxlor/froxlor Composer Medium Fix reported
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APICVE-2026-30932 · GHSA-X6W6-2XWP-3JH6 froxlor/froxlor Composer High Fix reported
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code ExecutionCVE-2026-41228 · GHSA-W59F-67XM-RXX7 froxlor/froxlor Composer Critical Fix reported
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email SpoofingCVE-2026-41232 · GHSA-VMJJ-QR7V-PXM6 froxlor/froxlor Composer Medium Fix reported