Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*

3 briefs RSS
high advisory

Stored XSS in Froxlor via Malicious Theme Configuration

Froxlor versions 2.0.0 through 2.3.13 are vulnerable to stored cross-site scripting (XSS) via the customer theme setting, allowing authenticated customers to compromise administrator sessions.

Froxlor +1 privilege-escalation vulnerability linux
3t 1c
critical advisory

Arbitrary File Deletion in Froxlor via Symlink Following

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion where authenticated users can plant symlinks to trigger recursive deletion by a root-privileged cron task, leading to potential data destruction.

Froxlor +3 information-disclosure api-security credential-access authentication-bypass vulnerability webserver web-vulnerability authorization-bypass +2
1r 11t 1c
medium advisory

CVE-2026-90937 Configuration Injection in Froxlor

Froxlor versions before 2.2.5 contain a vulnerability allowing authenticated users to inject arbitrary Nginx or Apache configuration directives via unvalidated newline characters in subdomain redirect URLs.

froxlor web-application-vulnerability configuration-injection server-hijacking
1t 1c