Security Advisories - froxlor/froxlor

froxlor/froxlor Security Advisories (40)

[MEDIUM] Froxlor has an HTML Injection Vulnerability

PKSA-rmd1-7gwd-nktx CVE-2025-48958 GHSA-26xq-m8xw-6373

Affected version: <=2.2.5

Reported by:
GitHub
[MEDIUM] Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

PKSA-7t7y-8d9m-zjrw CVE-2025-29773 GHSA-7j6w-p859-464f

Affected version: <=2.2.5

Reported by:
GitHub
[HIGH] Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>

PKSA-yp36-zcg2-t1x4 GHSA-34qg-65m4-f23m

Affected version: <=2.2.0-rc3

Reported by:
GitHub
[CRITICAL] Blind XSS Leading to Froxlor Application Compromise

PKSA-2bvk-dn1k-jgtg CVE-2024-34070 GHSA-x525-54hf-xr53

Affected version: <2.1.9

Reported by:
GitHub
[HIGH] Froxlor username/surname AND company field Bypass

PKSA-94d1-2fmr-db7c CVE-2023-50256 GHSA-625g-fm5w-w7w4

Affected version: <=2.1.1

Reported by:
GitHub
[CRITICAL] Froxlor Improper Input Validation vulnerability

PKSA-mhbb-j5t7-nknm CVE-2023-6069 GHSA-4jch-8qq5-hqg6

Affected version: <2.1.0-beta1

Reported by:
GitHub
[MEDIUM] Cross-site Scripting (XSS) in froxlor/froxlor

PKSA-7ypx-w6wf-3q58 CVE-2023-4829 GHSA-cvwv-h85m-w37h

Affected version: <2.0.22

Reported by:
GitHub
[MEDIUM] Cross-site Scripting (XSS) in froxlor/froxlor

PKSA-rt44-qxj1-12c7 CVE-2023-5564 GHSA-j5hq-6frc-64v3

Affected version: <2.1.0-dev1

Reported by:
GitHub
[LOW] Froxlor vulnerable to business logic errors

PKSA-g52h-rdch-wgq3 CVE-2023-4304 GHSA-9rmf-6qgj-g3wj

Affected version: <2.0.22

Reported by:
GitHub
[CRITICAL] Froxlor vulnerable to Improper Encoding or Escaping of Output

PKSA-65v9-z1rw-mzb5 CVE-2023-3668 GHSA-c6v5-pf66-xfq8

Affected version: <2.0.21

Reported by:
GitHub
[MEDIUM] Froxlor Session Fixation vulnerability

PKSA-t6cp-pc2s-dd4x CVE-2023-3192 GHSA-jr66-9ghf-6gp3

Affected version: <2.1.0

Reported by:
GitHub
[CRITICAL] Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts

PKSA-hccz-hs29-mqsx CVE-2023-3173 GHSA-chw4-88xc-79w6

Affected version: <2.0.20

Reported by:
GitHub
[HIGH] Froxlor vulnerable to Path Traversal

PKSA-23qg-5ycx-pktz CVE-2023-3172 GHSA-ghqq-jfx7-f6m9

Affected version: <2.0.20

Reported by:
GitHub
[MEDIUM] Froxlor vulnerable to Allocation of Resources Without Limits or Throttling

PKSA-h83c-h2wd-ddkg CVE-2023-2666 GHSA-4gm9-c9jq-g523

Affected version: <2.0.16

Reported by:
GitHub
[CRITICAL] froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type

PKSA-prs9-yg3j-g3kv CVE-2023-2034 GHSA-qwvp-g9j7-28f6

Affected version: <2.0.14

Reported by:
GitHub
[CRITICAL] Froxlor is vulnerable to authentication bypass

PKSA-6y4z-4r8g-7cfk CVE-2023-1307 GHSA-j83x-r9qq-9g4v

Affected version: <2.0.13

Reported by:
GitHub
[HIGH] Froxlor Cross-Site Request Forgery vulnerability

PKSA-nq8y-v5xg-3rjj CVE-2023-1033 GHSA-p7qq-rrvw-x55x

Affected version: <2.0.11

Reported by:
GitHub
[HIGH] Code Injection in froxlor/froxlor

PKSA-y2p5-gr81-xyk9 CVE-2023-0877 GHSA-vp4r-h765-5mwp

Affected version: <2.0.11

Reported by:
GitHub
[HIGH] froxlor is vulnerable to privilege escalation from customer to root via directory-options

PKSA-xx8s-h9wz-676j CVE-2023-0671 GHSA-9fqc-9cpr-w73q

Affected version: <2.0.10

Reported by:
GitHub
[MEDIUM] Froxlor contains Static Code Injection

PKSA-v72n-6cc8-sm8r CVE-2023-0566 GHSA-w7w4-qjgg-372x

Affected version: <2.0.10

Reported by:
GitHub
[MEDIUM] Froxlor contains Business Logic Errors

PKSA-k44n-5k61-zjy7 CVE-2023-0565 GHSA-vqqm-c9gx-773q

Affected version: <2.0.10

Reported by:
GitHub
[MEDIUM] Froxlor contains Unchecked Error Condition

PKSA-zmb6-7wzk-791q CVE-2023-0572 GHSA-3chw-8jq2-w769

Affected version: <2.0.10

Reported by:
GitHub
[HIGH] Froxlor contains Weak Password Requirements

PKSA-q6wt-gpp7-cn4g CVE-2023-0564 GHSA-pm72-27mg-fc28

Affected version: <2.0.10

Reported by:
GitHub
[MEDIUM] Froxlor is vulnerable to path traversal

PKSA-5s6p-5qzp-btk3 CVE-2023-0316 GHSA-xp3g-2729-rxm3

Affected version: <2.0.0

Reported by:
GitHub
[HIGH] Froxlor vulnerable to Command Injection

PKSA-hx3h-bnnr-cggy CVE-2023-0315 GHSA-cp68-42pf-6627

Affected version: <2.0.8

Reported by:
GitHub
[MEDIUM] Froxlor Improper Authorization vulnerability

PKSA-sf6x-66fc-hsdx CVE-2022-4868 GHSA-w6qf-j4qr-f946

Affected version: >=2.0.0-beta0,<2.0.0-beta1

Reported by:
GitHub
[MEDIUM] Froxlor vulnerable to Cross-Site Request Forgery

PKSA-h9g5-jcmy-czqf CVE-2022-4867 GHSA-6gwx-gw56-qhf7

Affected version: >=2.0.0-beta0,<2.0.0-beta1

Reported by:
GitHub
[MEDIUM] Froxlor vulnerable to Argument Injection

PKSA-692s-ms2h-tr65 CVE-2022-4864 GHSA-3v7m-2jrh-vc93

Affected version: >=2.0.0-beta0,<2.0.0-beta1

Reported by:
GitHub
[MEDIUM] Froxlor vulnerable to code injection

PKSA-f7rc-c463-gv7g CVE-2022-3869 GHSA-6rjv-xxgr-v57x

Affected version: <0.10.38.2

Reported by:
GitHub
[MEDIUM] Froxlor vulnerable to Code Injection

PKSA-4sh8-qdr3-sktp CVE-2022-3721 GHSA-h95w-p3x6-wwj6

Affected version: <0.10.39

Reported by:
GitHub
[MEDIUM] Froxlor vulnerable to Cross-Site Request Forgery (CSRF)

PKSA-fbs1-xsmw-h7sq CVE-2022-3017 GHSA-9xgp-3mxp-rv7x

Affected version: <0.10.38

Reported by:
GitHub
[MEDIUM] Foxlor cross-site scripting (XSS) vulnerability

PKSA-g77m-t12n-2hwc CVE-2020-28957 GHSA-cv24-vh45-4hjm

Affected version: =0.10.16

Reported by:
GitHub
[CRITICAL] Froxlor SQL injection vulnerability

PKSA-px4s-z4fz-x2vg CVE-2021-42325 GHSA-6fvw-x6gw-4wv8

Affected version: <=0.10.29.1

Reported by:
GitHub
[MEDIUM] Froxlor Exposure of Sensitive Information to an Unauthorized Actor

PKSA-nh5g-t3p8-m71c CVE-2020-10237 GHSA-j9wr-mj69-cqmv

Affected version: <=0.10.15

Reported by:
GitHub
[MEDIUM] Froxlor Information Disclosure

PKSA-z9nh-q651-nvd1 CVE-2020-10236 GHSA-hvgf-2rf7-wrx9

Affected version: <0.10.14

Reported by:
GitHub
[HIGH] Froxlor arbitrary code execution via the database configuration options

PKSA-xczw-nsyg-wsxk CVE-2020-10235 GHSA-p29c-jpgj-v57r

Affected version: <0.10.14

Reported by:
GitHub
[CRITICAL] Froxlor guessable password reset token

PKSA-2jdh-sss1-hwtn CVE-2016-5100 GHSA-qj6h-m7xc-r2v3

Affected version: <0.9.35

Reported by:
GitHub
[HIGH] Froxlor Incorrect Access Control

PKSA-9b3z-3rqb-smpb CVE-2018-12642 GHSA-r6g8-mq9v-cgp4

Affected version: <0.9.40

Reported by:
GitHub
[HIGH] Froxlor PHP Object Injection vulnerability

PKSA-x34r-qmcz-3kcr CVE-2018-1000527 GHSA-g77v-m226-3f7g

Affected version: <0.9.40

Reported by:
GitHub
[MEDIUM] HTML Injection in Froxlor

PKSA-qhdk-vyx1-6nwj CVE-2020-29653 GHSA-j739-gw6q-f4c7

Affected version: <=0.10.22

Reported by:
GitHub

froxlor/froxlor Security Advisories (40)

[MEDIUM] Froxlor has an HTML Injection Vulnerability

[MEDIUM] Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

[HIGH] Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>

[CRITICAL] Blind XSS Leading to Froxlor Application Compromise

[HIGH] Froxlor username/surname AND company field Bypass

[CRITICAL] Froxlor Improper Input Validation vulnerability

[MEDIUM] Cross-site Scripting (XSS) in froxlor/froxlor

[MEDIUM] Cross-site Scripting (XSS) in froxlor/froxlor

[LOW] Froxlor vulnerable to business logic errors

[CRITICAL] Froxlor vulnerable to Improper Encoding or Escaping of Output

[MEDIUM] Froxlor Session Fixation vulnerability

[CRITICAL] Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts

[HIGH] Froxlor vulnerable to Path Traversal

[MEDIUM] Froxlor vulnerable to Allocation of Resources Without Limits or Throttling

[CRITICAL] froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type

[CRITICAL] Froxlor is vulnerable to authentication bypass

[HIGH] Froxlor Cross-Site Request Forgery vulnerability

[HIGH] Code Injection in froxlor/froxlor

[HIGH] froxlor is vulnerable to privilege escalation from customer to root via directory-options

[MEDIUM] Froxlor contains Static Code Injection

[MEDIUM] Froxlor contains Business Logic Errors

[MEDIUM] Froxlor contains Unchecked Error Condition

[HIGH] Froxlor contains Weak Password Requirements

[MEDIUM] Froxlor is vulnerable to path traversal

[HIGH] Froxlor vulnerable to Command Injection

[MEDIUM] Froxlor Improper Authorization vulnerability

[MEDIUM] Froxlor vulnerable to Cross-Site Request Forgery

[MEDIUM] Froxlor vulnerable to Argument Injection

[MEDIUM] Froxlor vulnerable to code injection

[MEDIUM] Froxlor vulnerable to Code Injection

[MEDIUM] Froxlor vulnerable to Cross-Site Request Forgery (CSRF)

[MEDIUM] Foxlor cross-site scripting (XSS) vulnerability

[CRITICAL] Froxlor SQL injection vulnerability

[MEDIUM] Froxlor Exposure of Sensitive Information to an Unauthorized Actor

[MEDIUM] Froxlor Information Disclosure

[HIGH] Froxlor arbitrary code execution via the database configuration options

[CRITICAL] Froxlor guessable password reset token

[HIGH] Froxlor Incorrect Access Control

[HIGH] Froxlor PHP Object Injection vulnerability

[MEDIUM] HTML Injection in Froxlor