froxlor.

Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

• froxlor
• Information disclosure

Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

• froxlor
• Broken access control

Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

• froxlor
• Broken access control

Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

• froxlor
• Path traversal

Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

• froxlor
• Broken access control

Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

• froxlor
• Broken access control

Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

• froxlor
• Broken access control

Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API

• froxlor
• Broken access control

Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

• froxlor
• Other injection

Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

• froxlor
• Cross-site scripting (XSS)

Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

• froxlor
• Cross-site scripting (XSS)

Froxlor before 2.3.12 Credential Disclosure via DirProtections API

• froxlor
• Information disclosure

Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

• froxlor
• Broken access control

froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

• froxlor
• Other injection

Froxlor before 2.3.12 Privilege Escalation via Symlink

• froxlor
• Path traversal

Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

• froxlor
• Path traversal

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

• froxlor
• Command injection

Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

• froxlor
• Race condition

froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

• froxlor
• Cross-site request forgery (CSRF)

froxlor before 2.3.12 Authentication Bypass via Session Persistence

• froxlor
• Authentication bypass

Froxlor before 2.3.12 DKIM Private Key Disclosure via API

• froxlor
• Information disclosure

Froxlor before 2.3.11 2FA Bypass via Namespace Confusion

• froxlor
• Authentication bypass

Froxlor before 2.3.13 Private Key Disclosure via Certificates API

• froxlor
• Information disclosure

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

• froxlor
• Other injection

Froxlor before 2.3.12 SSH Key Injection via authorized_keys

• Froxlor
• Other injection