# froxlor.

Every CVE that names froxlor among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php](https://agentprime.io/advisories/CVE-2026-121436.md)
  `CVE-2026-121436` · CVE record: froxlor froxlor · CVSS 8.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure
- [Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API](https://agentprime.io/advisories/CVE-2026-121435.md)
  `CVE-2026-121435` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API](https://agentprime.io/advisories/CVE-2026-121434.md)
  `CVE-2026-121434` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron](https://agentprime.io/advisories/CVE-2026-113678.md)
  `CVE-2026-113678` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API](https://agentprime.io/advisories/CVE-2026-113677.md)
  `CVE-2026-113677` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API](https://agentprime.io/advisories/CVE-2026-113676.md)
  `CVE-2026-113676` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php](https://agentprime.io/advisories/CVE-2026-109963.md)
  `CVE-2026-109963` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API](https://agentprime.io/advisories/CVE-2026-109962.md)
  `CVE-2026-109962` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members](https://agentprime.io/advisories/CVE-2026-109961.md)
  `CVE-2026-109961` · CVE record: froxlor froxlor · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection
- [Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value](https://agentprime.io/advisories/CVE-2026-109960.md)
  `CVE-2026-109960` · CVE record: froxlor froxlor · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Froxlor before 2.3.12 Stored XSS via SSL certificate issuer](https://agentprime.io/advisories/CVE-2026-100720.md)
  `CVE-2026-100720` · CVE record: froxlor froxlor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Froxlor before 2.3.12 Credential Disclosure via DirProtections API](https://agentprime.io/advisories/CVE-2026-100719.md)
  `CVE-2026-100719` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Froxlor before 2.3.12 Authentication Bypass via EmailSender.add](https://agentprime.io/advisories/CVE-2026-100718.md)
  `CVE-2026-100718` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [froxlor before 2.3.12 CRLF Injection via validateUrl userinfo](https://agentprime.io/advisories/CVE-2026-100717.md)
  `CVE-2026-100717` · CVE record: froxlor froxlor · CVSS 8.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection
- [Froxlor before 2.3.12 Privilege Escalation via Symlink](https://agentprime.io/advisories/CVE-2026-100716.md)
  `CVE-2026-100716` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Froxlor before 2.3.12 Arbitrary File Deletion via Symlink](https://agentprime.io/advisories/CVE-2026-100715.md)
  `CVE-2026-100715` · CVE record: froxlor froxlor · CVSS 8.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Froxlor before 2.3.12 Command Injection via letsencryptchallengepath](https://agentprime.io/advisories/CVE-2026-100714.md)
  `CVE-2026-100714` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Command injection
- [Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync](https://agentprime.io/advisories/CVE-2026-100713.md)
  `CVE-2026-100713` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Race condition
- [froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF](https://agentprime.io/advisories/CVE-2026-100712.md)
  `CVE-2026-100712` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [froxlor before 2.3.12 Authentication Bypass via Session Persistence](https://agentprime.io/advisories/CVE-2026-100711.md)
  `CVE-2026-100711` · CVE record: froxlor froxlor · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Froxlor before 2.3.12 DKIM Private Key Disclosure via API](https://agentprime.io/advisories/CVE-2026-100710.md)
  `CVE-2026-100710` · CVE record: froxlor froxlor · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Froxlor before 2.3.11 2FA Bypass via Namespace Confusion](https://agentprime.io/advisories/CVE-2026-100709.md)
  `CVE-2026-100709` · CVE record: froxlor froxlor · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Froxlor before 2.3.13 Private Key Disclosure via Certificates API](https://agentprime.io/advisories/CVE-2026-100708.md)
  `CVE-2026-100708` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL](https://agentprime.io/advisories/CVE-2026-90937.md)
  `CVE-2026-90937` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection
- [Froxlor before 2.3.12 SSH Key Injection via authorized_keys](https://agentprime.io/advisories/CVE-2026-90767.md)
  `CVE-2026-90767` · CVE record: froxlor Froxlor · CVSS 7.1 High · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=froxlor>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/froxlor/>. Everything for agents: <https://agentprime.io/llms.txt>.