{"schema_version":1,"title":"froxlor/froxlor (Packagist) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in froxlor/froxlor (Packagist): 0 in the last 7 days and 7 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-62988, was published on 18 August 2026.","url":"https://junglewise.ai/threats/technologies/froxlor-froxlor","json_url":"https://junglewise.ai/threats/technologies/froxlor-froxlor.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/froxlor-froxlor","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":8,"all_time":18,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":7,"last_365_days":18},"latest":[{"cve":"CVE-2026-62988","cvss":9,"epss":0.0063,"slug":"cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure","title":"Froxlor API credential and 2FA secret disclosure","severity":"critical","exploited":false,"published_at":"2026-08-18T20:48:35+00:00","url":"https://junglewise.ai/threats/cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure"},{"cve":"CVE-2026-55593","cvss":6.5,"epss":0.0026,"slug":"cve-2026-55593-froxlor-csrf-vulnerability-in-ajax-endpoint","title":"Froxlor CSRF vulnerability in AJAX endpoint","severity":"medium","exploited":false,"published_at":"2026-08-18T20:48:30+00:00","url":"https://junglewise.ai/threats/cve-2026-55593-froxlor-csrf-vulnerability-in-ajax-endpoint"},{"cve":"CVE-2026-54543","cvss":5.4,"epss":0.0045,"slug":"cve-2026-54543-froxlor-domainzones-add-dns-zone-file-injection","title":"Froxlor DomainZones.add DNS zone-file injection","severity":"medium","exploited":false,"published_at":"2026-08-18T20:48:04+00:00","url":"https://junglewise.ai/threats/cve-2026-54543-froxlor-domainzones-add-dns-zone-file-injection"},{"cve":"CVE-2026-54348","cvss":7.2,"epss":0.0066,"slug":"cve-2026-54348-froxlor-second-order-sql-injection-in-ipsandports-listing","title":"Froxlor second-order SQL injection in IpsAndPorts.listing","severity":"high","exploited":false,"published_at":"2026-08-18T20:47:59+00:00","url":"https://junglewise.ai/threats/cve-2026-54348-froxlor-second-order-sql-injection-in-ipsandports-listing"},{"cve":"CVE-2026-54347","cvss":8.7,"epss":0.0042,"slug":"cve-2026-54347-froxlor-stored-xss-in-dns-editor-via-txt-records","title":"Froxlor stored XSS in DNS editor via TXT records","severity":"high","exploited":false,"published_at":"2026-08-18T20:47:53+00:00","url":"https://junglewise.ai/threats/cve-2026-54347-froxlor-stored-xss-in-dns-editor-via-txt-records"},{"cvss":4.3,"slug":"froxlor-authorization-bypass-in-mysqls-add-api-2dea4946","title":"Froxlor authorization bypass in Mysqls.add API","severity":"medium","exploited":false,"published_at":"2026-07-02T19:23:49+00:00","url":"https://junglewise.ai/threats/froxlor-authorization-bypass-in-mysqls-add-api-2dea4946"},{"cvss":4.3,"slug":"froxlor-information-disclosure-in-sender-alias-delete-confirmation-4661365f","title":"Froxlor information disclosure in sender alias delete confirmation","severity":"medium","exploited":false,"published_at":"2026-07-02T19:23:31+00:00","url":"https://junglewise.ai/threats/froxlor-information-disclosure-in-sender-alias-delete-confirmation-4661365f"},{"cve":"CVE-2026-41237","cvss":6.5,"slug":"cve-2026-41237-froxlor-dns-zone-file-injection-via-improper-record-validation","title":"Froxlor DNS zone file injection via improper record validation","severity":"medium","exploited":false,"published_at":"2026-06-04T19:16:29.503+00:00","url":"https://junglewise.ai/threats/cve-2026-41237-froxlor-dns-zone-file-injection-via-improper-record-validation"},{"cve":"CVE-2026-41236","cvss":8.8,"slug":"cve-2026-41236-froxlor-privilege-escalation-via-symlink-following-in-ssh-key","title":"Froxlor privilege escalation via symlink following in SSH key sync","severity":"high","exploited":false,"published_at":"2026-06-04T19:16:29.327+00:00","url":"https://junglewise.ai/threats/cve-2026-41236-froxlor-privilege-escalation-via-symlink-following-in-ssh-key"},{"cve":"CVE-2026-41235","cvss":8.8,"slug":"cve-2026-41235-froxlor-incorrect-authorization-in-ftp-shell-assignment","title":"Froxlor incorrect authorization in FTP shell assignment","severity":"high","exploited":false,"published_at":"2026-06-04T19:16:29.153+00:00","url":"https://junglewise.ai/threats/cve-2026-41235-froxlor-incorrect-authorization-in-ftp-shell-assignment"},{"cve":"CVE-2026-41234","cvss":7.6,"slug":"cve-2026-41234-froxlor-bind-zone-file-injection-in-domainzones-api-txt-records","title":"Froxlor BIND zone file injection in DomainZones API TXT records","severity":"high","exploited":false,"published_at":"2026-06-04T19:16:28.963+00:00","url":"https://junglewise.ai/threats/cve-2026-41234-froxlor-bind-zone-file-injection-in-domainzones-api-txt-records"},{"cvss":8.1,"slug":"froxlor-api-two-factor-authentication-bypass-139d8b22","title":"Froxlor API two-factor authentication bypass","severity":"high","exploited":false,"published_at":"2026-06-03T21:41:12+00:00","url":"https://junglewise.ai/threats/froxlor-api-two-factor-authentication-bypass-139d8b22"},{"cve":"CVE-2026-41228","cvss":9.9,"slug":"cve-2026-41228-froxlor-has-local-file-inclusion-via-path-traversal-in-api-def","title":"Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution","severity":"critical","exploited":false,"published_at":"2026-04-16T01:02:12+00:00","url":"https://junglewise.ai/threats/cve-2026-41228-froxlor-has-local-file-inclusion-via-path-traversal-in-api-def"},{"cve":"CVE-2026-41229","cvss":9.1,"slug":"cve-2026-41229-froxlor-has-a-php-code-injection-via-unescaped-single-quotes-in","title":"Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)","severity":"critical","exploited":false,"published_at":"2026-04-16T00:50:00+00:00","url":"https://junglewise.ai/threats/cve-2026-41229-froxlor-has-a-php-code-injection-via-unescaped-single-quotes-in"},{"cve":"CVE-2026-41230","cvss":8.5,"slug":"cve-2026-41230-froxlor-has-a-bind-zone-file-injection-via-unsanitized-dns-record","title":"Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()","severity":"high","exploited":false,"published_at":"2026-04-16T00:47:26+00:00","url":"https://junglewise.ai/threats/cve-2026-41230-froxlor-has-a-bind-zone-file-injection-via-unsanitized-dns-record"},{"cve":"CVE-2026-41231","cvss":7.5,"slug":"cve-2026-41231-froxlor-has-incomplete-symlink-validation-in-datadump-add-allows","title":"Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron","severity":"high","exploited":false,"published_at":"2026-04-16T00:47:18+00:00","url":"https://junglewise.ai/threats/cve-2026-41231-froxlor-has-incomplete-symlink-validation-in-datadump-add-allows"},{"cve":"CVE-2026-41232","cvss":5,"slug":"cve-2026-41232-froxlor-has-an-email-sender-alias-domain-ownership-bypass-via","title":"Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing","severity":"medium","exploited":false,"published_at":"2026-04-16T00:47:05+00:00","url":"https://junglewise.ai/threats/cve-2026-41232-froxlor-has-an-email-sender-alias-domain-ownership-bypass-via"},{"cve":"CVE-2026-41233","cvss":5.4,"slug":"cve-2026-41233-froxlor-has-a-reseller-domain-quota-bypass-via-unvalidated","title":"Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()","severity":"medium","exploited":false,"published_at":"2026-04-16T00:46:47+00:00","url":"https://junglewise.ai/threats/cve-2026-41233-froxlor-has-a-reseller-domain-quota-bypass-via-unvalidated"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":1,"exploited":0,"vulnerabilities":5},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"getgrav/grav (Packagist)","slug":"getgrav-grav","vulnerabilities":63,"url":"https://junglewise.ai/threats/technologies/getgrav-grav"},{"name":"wwbn/avideo (Packagist)","slug":"wwbn-avideo","vulnerabilities":58,"url":"https://junglewise.ai/threats/technologies/wwbn-avideo"},{"name":"concrete5/concrete5 (Packagist)","slug":"concrete5-concrete5","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/concrete5-concrete5"},{"name":"snipe/snipe-it (Packagist)","slug":"snipe-snipe-it","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/snipe-snipe-it"},{"name":"thorsten/phpmyfaq (Packagist)","slug":"thorsten-phpmyfaq","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/thorsten-phpmyfaq"},{"name":"phpmyfaq/phpmyfaq (Packagist)","slug":"phpmyfaq-phpmyfaq","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq"},{"name":"craftcms/cms (Packagist)","slug":"craftcms-cms","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/craftcms-cms"},{"name":"mantisbt/mantisbt (Packagist)","slug":"mantisbt-mantisbt","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/mantisbt-mantisbt"},{"name":"kimai/kimai (Packagist)","slug":"kimai-kimai","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/kimai-kimai"},{"name":"yeswiki/yeswiki (Packagist)","slug":"yeswiki-yeswiki","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/yeswiki-yeswiki"},{"name":"twig/twig (Packagist)","slug":"twig-twig","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/twig-twig"},{"name":"shopper/framework (Packagist)","slug":"shopper-framework","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/shopper-framework"}],"technology":{"hub":true,"name":"froxlor/froxlor (Packagist)","slug":"froxlor-froxlor","vendor":{"name":"Packagist","slug":"packagist","url":"https://junglewise.ai/threats/vendors/packagist"},"aliases":[],"homepage":"https://www.froxlor.org/","repo_url":"https://github.com/Froxlor/Froxlor","description":"Froxlor is an open-source server administration control panel for managing web hosting environments.","url":"https://junglewise.ai/threats/technologies/froxlor-froxlor"},"most_severe":[{"cve":"CVE-2026-41228","cvss":9.9,"slug":"cve-2026-41228-froxlor-has-local-file-inclusion-via-path-traversal-in-api-def","title":"Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution","severity":"critical","exploited":false,"published_at":"2026-04-16T01:02:12+00:00","url":"https://junglewise.ai/threats/cve-2026-41228-froxlor-has-local-file-inclusion-via-path-traversal-in-api-def"},{"cve":"CVE-2026-41229","cvss":9.1,"slug":"cve-2026-41229-froxlor-has-a-php-code-injection-via-unescaped-single-quotes-in","title":"Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)","severity":"critical","exploited":false,"published_at":"2026-04-16T00:50:00+00:00","url":"https://junglewise.ai/threats/cve-2026-41229-froxlor-has-a-php-code-injection-via-unescaped-single-quotes-in"},{"cve":"CVE-2026-62988","cvss":9,"epss":0.0063,"slug":"cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure","title":"Froxlor API credential and 2FA secret disclosure","severity":"critical","exploited":false,"published_at":"2026-08-18T20:48:35+00:00","url":"https://junglewise.ai/threats/cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure"},{"cve":"CVE-2026-41236","cvss":8.8,"slug":"cve-2026-41236-froxlor-privilege-escalation-via-symlink-following-in-ssh-key","title":"Froxlor privilege escalation via symlink following in SSH key sync","severity":"high","exploited":false,"published_at":"2026-06-04T19:16:29.327+00:00","url":"https://junglewise.ai/threats/cve-2026-41236-froxlor-privilege-escalation-via-symlink-following-in-ssh-key"},{"cve":"CVE-2026-41235","cvss":8.8,"slug":"cve-2026-41235-froxlor-incorrect-authorization-in-ftp-shell-assignment","title":"Froxlor incorrect authorization in FTP shell assignment","severity":"high","exploited":false,"published_at":"2026-06-04T19:16:29.153+00:00","url":"https://junglewise.ai/threats/cve-2026-41235-froxlor-incorrect-authorization-in-ftp-shell-assignment"},{"cve":"CVE-2026-54347","cvss":8.7,"epss":0.0042,"slug":"cve-2026-54347-froxlor-stored-xss-in-dns-editor-via-txt-records","title":"Froxlor stored XSS in DNS editor via TXT records","severity":"high","exploited":false,"published_at":"2026-08-18T20:47:53+00:00","url":"https://junglewise.ai/threats/cve-2026-54347-froxlor-stored-xss-in-dns-editor-via-txt-records"},{"cve":"CVE-2026-41230","cvss":8.5,"slug":"cve-2026-41230-froxlor-has-a-bind-zone-file-injection-via-unsanitized-dns-record","title":"Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()","severity":"high","exploited":false,"published_at":"2026-04-16T00:47:26+00:00","url":"https://junglewise.ai/threats/cve-2026-41230-froxlor-has-a-bind-zone-file-injection-via-unsanitized-dns-record"},{"cvss":8.1,"slug":"froxlor-api-two-factor-authentication-bypass-139d8b22","title":"Froxlor API two-factor authentication bypass","severity":"high","exploited":false,"published_at":"2026-06-03T21:41:12+00:00","url":"https://junglewise.ai/threats/froxlor-api-two-factor-authentication-bypass-139d8b22"},{"cve":"CVE-2026-41234","cvss":7.6,"slug":"cve-2026-41234-froxlor-bind-zone-file-injection-in-domainzones-api-txt-records","title":"Froxlor BIND zone file injection in DomainZones API TXT records","severity":"high","exploited":false,"published_at":"2026-06-04T19:16:28.963+00:00","url":"https://junglewise.ai/threats/cve-2026-41234-froxlor-bind-zone-file-injection-in-domainzones-api-txt-records"},{"cve":"CVE-2026-41231","cvss":7.5,"slug":"cve-2026-41231-froxlor-has-incomplete-symlink-validation-in-datadump-add-allows","title":"Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron","severity":"high","exploited":false,"published_at":"2026-04-16T00:47:18+00:00","url":"https://junglewise.ai/threats/cve-2026-41231-froxlor-has-incomplete-symlink-validation-in-datadump-add-allows"}],"generated_at":"2026-09-26T10:22:00.132594+00:00"}