Technology · Froxlor
Froxlor vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 43 vulnerabilities in Froxlor: 0 in the last 7 days and 33 in the last 90 days, 9 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121436, was published on 3 November 2026. 10 vulnerabilities in the last four weeks, down 41% on the four before (17). 1 critical against 5.
- Last 7 days
- 0
- Last 90 days
- 33
- Critical, all time
- 9
- Exploited in the wild
- 0
About Froxlor
Froxlor is a web server control panel for managing hosting accounts and server configuration.
Latest Froxlor vulnerabilities
- CVE-2026-121436: Froxlor information disclosure in API keys listinghighCVSS 7.2
- CVE-2026-121435: Froxlor authorization bypass in Mysqls.add APImediumCVSS 4.3
- CVE-2026-121434: Froxlor Certificates API authorization bypass in Let's Encrypt managementmediumCVSS 5.4
- CVE-2026-113678: Froxlor symlink following in Statistics::makeChownWithNewStatscriticalCVSS 9.9
- CVE-2026-113677: Froxlor missing authorization in SubDomains.delete APImediumCVSS 5.4
- CVE-2026-113676: Froxlor authorization bypass in Admins.get APImediumCVSS 4.3
- CVE-2026-109963: Froxlor insecure direct object reference in email template editormediumCVSS 4.3EPSS 0.2%
- CVE-2026-109962: Froxlor missing authorization in MySQL server and cronjob APImediumCVSS 4.3EPSS 0.2%
- CVE-2026-109961: Froxlor newline injection in Ftps.add API group databasehighCVSS 8.5EPSS 0.2%
- CVE-2026-109960: Froxlor stored cross-site scripting in theme fieldhighCVSS 7.7EPSS 0.3%
- CVE-2026-100720: Froxlor stored cross-site scripting in SSL certificate issuerhighCVSS 8.7
- CVE-2026-100719: Froxlor credential disclosure in DirProtections.listing APImediumCVSS 6.5
- CVE-2026-100718: Froxlor API policy bypass in EmailSender.addhighCVSS 7.1
- CVE-2026-100717: froxlor CRLF injection in subdomain redirect validationcriticalCVSS 9.9
- CVE-2026-100716: Froxlor server administration panel symlink path traversal privilege escalationcriticalCVSS 9.9
- CVE-2026-100715: Froxlor arbitrary file deletion via symlink following in cron taskcriticalCVSS 9.6
- CVE-2026-100714: Froxlor argument injection in Let's Encrypt challenge path settingcriticalCVSS 9.1
- CVE-2026-100713: Froxlor SSH key synchronization race condition leading to root accesshighCVSS 7.8
- CVE-2026-100712: froxlor two-factor authentication disable via CSRF GET requestmediumCVSS 6.5
- CVE-2026-100711: froxlor session invalidation bypass on password changehighCVSS 7.5
- CVE-2026-100710: Froxlor information disclosure of DKIM private key via APImediumCVSS 4.9
- CVE-2026-100709: Froxlor TOTP bypass via 2FA token namespace confusionhighCVSS 7.5
- CVE-2026-100708: Froxlor information disclosure in Certificates APIhighCVSS 7.1
- CVE-2026-90937: froxlor CRLF injection in subdomain redirect URLscriticalCVSS 9.9EPSS 0.4%
- CVE-2026-90936: Froxlor information disclosure in sender alias lookupsmediumCVSS 4.3EPSS 0.3%
Most severe Froxlor vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-41228: Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code ExecutioncriticalCVSS 9.9EPSS 0.5%
- CVE-2026-90937: froxlor CRLF injection in subdomain redirect URLscriticalCVSS 9.9EPSS 0.4%
- CVE-2026-113678: Froxlor symlink following in Statistics::makeChownWithNewStatscriticalCVSS 9.9
- CVE-2026-100717: froxlor CRLF injection in subdomain redirect validationcriticalCVSS 9.9
- CVE-2026-100716: Froxlor server administration panel symlink path traversal privilege escalationcriticalCVSS 9.9
- CVE-2026-100715: Froxlor arbitrary file deletion via symlink following in cron taskcriticalCVSS 9.6
- CVE-2026-41229: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)criticalCVSS 9.1EPSS 0.5%
- CVE-2026-100714: Froxlor argument injection in Let's Encrypt challenge path settingcriticalCVSS 9.1
- CVE-2026-62988: Froxlor API credential and 2FA secret disclosurecriticalCVSS 9EPSS 0.6%
- CVE-2026-41236: Froxlor privilege escalation via symlink following in SSH key synchighCVSS 8.8EPSS 0.6%
Vulnerabilities per week
10 vulnerabilities in the last four weeks, down 41% on the four before (17). 1 critical against 5. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 5 | 1 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 4 | 1 | |
| 21 Sep 2026 | 13 | 4 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 4 | 0 | |
| 19 Oct 2026 | 3 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 3 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Froxlor vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/froxlor)<a href="https://junglewise.ai/threats/technologies/froxlor"><img src="https://junglewise.ai/threats/technologies/froxlor/badge.svg" alt="Froxlor vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/froxlor.json, and this page as text at https://junglewise.ai/threats/technologies/froxlor.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Froxlor vulnerabilities", https://junglewise.ai/threats/technologies/froxlor, 13 November 2026.