CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,503 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,503
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product froxlor:froxlor. Show all products

36 CVEs, showing 1 to 36
CVESeverityTitlePublished
CVE-2026-26279Critical 9.1Froxlor is open source server administration software.Mar 3, 2026
CVE-2026-30932High 8.8Froxlor is open source server administration software.Mar 24, 2026
CVE-2026-41228Critical 9.9Froxlor is open source server administration software.Apr 23, 2026
CVE-2026-41229Critical 9.1Froxlor is open source server administration software.Apr 23, 2026
CVE-2026-41230High 8.5Froxlor is open source server administration software.Apr 23, 2026
CVE-2026-41231High 7.5Froxlor is open source server administration software.Apr 23, 2026
CVE-2026-41232Medium 5.0Froxlor is open source server administration software.Apr 23, 2026
CVE-2026-41233Medium 5.4Froxlor is open source server administration software.Apr 23, 2026
CVE-2026-52793High 8.1Froxlor: API Authentication bypasses 2FA Authentication
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-62988Critical 9.0Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-54543Medium 5.4Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-54348High 7.2Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-54347High 8.7Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-55593Medium 6.5Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-90767Medium 6.5Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Assigned by VulnCheck
Sep 13, 2026
CVE-2024-58383High 7.3Froxlor before 2.2.0 Insecure File Permissions mysql.conf
Assigned by VulnCheck
Sep 14, 2026
CVE-2026-90935Medium 4.3Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
Assigned by VulnCheck
Sep 14, 2026
CVE-2026-90936Medium 4.3Froxlor before 2.3.7 Information Disclosure via customer_email.php
Assigned by VulnCheck
Sep 14, 2026
CVE-2026-90937Critical 9.9froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
Assigned by VulnCheck
Sep 14, 2026
CVE-2026-100708High 7.1Froxlor before 2.3.13 Private Key Disclosure via Certificates API
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100709High 7.5Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100710Medium 4.9Froxlor before 2.3.12 DKIM Private Key Disclosure via API
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100711High 7.5froxlor before 2.3.12 Authentication Bypass via Session Persistence
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100712Medium 6.5froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100713High 7.8Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100714Critical 9.1Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100715Critical 9.6Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100716Critical 9.9Froxlor before 2.3.12 Privilege Escalation via Symlink
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100717Critical 9.9froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100718High 7.1Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100719Medium 6.5Froxlor before 2.3.12 Credential Disclosure via DirProtections API
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100720High 8.7Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-109960High 7.7Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-109961High 8.5Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-109962Medium 4.3Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-109963Medium 4.3Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
Assigned by VulnCheck
Oct 13, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.