# froxlor/froxlor (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/froxlor-froxlor Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/froxlor-froxlor.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 60 vulnerabilities in froxlor/froxlor (Packagist): 0 in the last 7 days and 9 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90936, was published on 14 September 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 9 - All time: 60 (3 critical, 0 exploited in the wild) ## About froxlor/froxlor (Packagist) Web hosting control panel written in PHP for managing domains, mail, and FTP accounts. ## Latest froxlor/froxlor (Packagist) vulnerabilities - [CVE-2026-90936: Froxlor information disclosure in sender alias lookups](https://junglewise.ai/threats/cve-2026-90936-froxlor-information-disclosure-in-sender-alias-lookups) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2026-90935: Froxlor authorization bypass in Mysqls.add API](https://junglewise.ai/threats/cve-2026-90935-froxlor-authorization-bypass-in-mysqls-add-api) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2024-58383: Froxlor insecure file permissions in pure-ftpd MySQL configuration](https://junglewise.ai/threats/cve-2024-58383-froxlor-insecure-file-permissions-in-pure-ftpd-mysql) (high, CVSS 7.3, published 14 Sep 2026) - [CVE-2026-62988: Froxlor API credential and 2FA secret disclosure](https://junglewise.ai/threats/cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure) (critical, CVSS 9, published 18 Aug 2026) - [CVE-2026-55593: Froxlor CSRF vulnerability in AJAX endpoint](https://junglewise.ai/threats/cve-2026-55593-froxlor-csrf-vulnerability-in-ajax-endpoint) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-54543: Froxlor DomainZones.add DNS zone-file injection](https://junglewise.ai/threats/cve-2026-54543-froxlor-domainzones-add-dns-zone-file-injection) (medium, CVSS 5.4, published 18 Aug 2026) - [CVE-2026-54348: Froxlor second-order SQL injection in IpsAndPorts.listing](https://junglewise.ai/threats/cve-2026-54348-froxlor-second-order-sql-injection-in-ipsandports-listing) (high, CVSS 7.2, published 18 Aug 2026) - [CVE-2026-54347: Froxlor stored XSS in DNS editor via TXT records](https://junglewise.ai/threats/cve-2026-54347-froxlor-stored-xss-in-dns-editor-via-txt-records) (high, CVSS 8.7, published 18 Aug 2026) - [CVE-2026-52793: Froxlor's API Authentication bypasses 2FA Authentication](https://junglewise.ai/threats/cve-2026-52793-froxlor-s-api-authentication-bypasses-2fa-authentication) (high, CVSS 8.1, published 18 Aug 2026) - [CVE-2026-41237: Froxlor DNS zone file injection via improper record validation](https://junglewise.ai/threats/cve-2026-41237-froxlor-dns-zone-file-injection-via-improper-record-validation) (medium, CVSS 4, published 4 Jun 2026) - [CVE-2026-41236: Froxlor privilege escalation via symlink following in SSH key sync](https://junglewise.ai/threats/cve-2026-41236-froxlor-privilege-escalation-via-symlink-following-in-ssh-key) (high, CVSS 8.8, published 4 Jun 2026) - [CVE-2026-41235: Froxlor incorrect authorization in FTP shell assignment](https://junglewise.ai/threats/cve-2026-41235-froxlor-incorrect-authorization-in-ftp-shell-assignment) (high, CVSS 8.8, published 4 Jun 2026) - [CVE-2026-41234: Froxlor BIND zone file injection in DomainZones API TXT records](https://junglewise.ai/threats/cve-2026-41234-froxlor-bind-zone-file-injection-in-domainzones-api-txt-records) (high, CVSS 7.6, published 4 Jun 2026) - [CVE-2026-41233: Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()](https://junglewise.ai/threats/cve-2026-41233-froxlor-has-a-reseller-domain-quota-bypass-via-unvalidated) (medium, CVSS 5.4, published 23 Apr 2026) - [CVE-2026-41232: Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing](https://junglewise.ai/threats/cve-2026-41232-froxlor-has-an-email-sender-alias-domain-ownership-bypass-via) (medium, CVSS 5, published 23 Apr 2026) - [CVE-2026-41231: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron](https://junglewise.ai/threats/cve-2026-41231-froxlor-has-incomplete-symlink-validation-in-datadump-add-allows) (high, CVSS 7.5, published 23 Apr 2026) - [CVE-2026-41230: Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()](https://junglewise.ai/threats/cve-2026-41230-froxlor-has-a-bind-zone-file-injection-via-unsanitized-dns-record) (high, CVSS 8.5, published 23 Apr 2026) - [CVE-2026-41229: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)](https://junglewise.ai/threats/cve-2026-41229-froxlor-has-a-php-code-injection-via-unescaped-single-quotes-in) (critical, CVSS 9.1, published 23 Apr 2026) - [CVE-2026-41228: Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution](https://junglewise.ai/threats/cve-2026-41228-froxlor-has-local-file-inclusion-via-path-traversal-in-api-def) (critical, CVSS 9.9, published 23 Apr 2026) - [CVE-2026-30932: Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API](https://junglewise.ai/threats/cve-2026-30932-froxlor-is-vulnerable-to-bind-zone-file-injection-via-unsanitized) (low, CVSS 3.1, published 24 Mar 2026) - [CVE-2026-26279: Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection](https://junglewise.ai/threats/cve-2026-26279-froxlor-has-admin-to-root-privilege-escalation-via-input) (low, CVSS 3.1, published 3 Mar 2026) - [CVE-2025-48958: Froxlor has an HTML Injection Vulnerability](https://junglewise.ai/threats/cve-2025-48958-froxlor-has-an-html-injection-vulnerability) (low, CVSS 3.1, published 11 Mar 2025) - [CVE-2025-29773: Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account…](https://junglewise.ai/threats/cve-2025-29773-froxlor-allows-multiple-accounts-to-share-the-same-email-address) (low, CVSS 3.1, published 11 Mar 2025) - [CVE-2024-34070: Blind XSS Leading to Froxlor Application Compromise](https://junglewise.ai/threats/cve-2024-34070-blind-xss-leading-to-froxlor-application-compromise) (low, CVSS 3.1, published 10 May 2024) - [CVE-2023-50256: Froxlor username/surname AND company field Bypass](https://junglewise.ai/threats/cve-2023-50256-froxlor-username-surname-and-company-field-bypass) (low, CVSS 3.1, published 4 Jan 2024) ## Most severe froxlor/froxlor (Packagist) vulnerabilities - [CVE-2026-41228: Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution](https://junglewise.ai/threats/cve-2026-41228-froxlor-has-local-file-inclusion-via-path-traversal-in-api-def) (critical, CVSS 9.9, published 23 Apr 2026) - [CVE-2026-41229: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)](https://junglewise.ai/threats/cve-2026-41229-froxlor-has-a-php-code-injection-via-unescaped-single-quotes-in) (critical, CVSS 9.1, published 23 Apr 2026) - [CVE-2026-62988: Froxlor API credential and 2FA secret disclosure](https://junglewise.ai/threats/cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure) (critical, CVSS 9, published 18 Aug 2026) - [CVE-2026-41236: Froxlor privilege escalation via symlink following in SSH key sync](https://junglewise.ai/threats/cve-2026-41236-froxlor-privilege-escalation-via-symlink-following-in-ssh-key) (high, CVSS 8.8, published 4 Jun 2026) - [CVE-2026-41235: Froxlor incorrect authorization in FTP shell assignment](https://junglewise.ai/threats/cve-2026-41235-froxlor-incorrect-authorization-in-ftp-shell-assignment) (high, CVSS 8.8, published 4 Jun 2026) - [CVE-2026-54347: Froxlor stored XSS in DNS editor via TXT records](https://junglewise.ai/threats/cve-2026-54347-froxlor-stored-xss-in-dns-editor-via-txt-records) (high, CVSS 8.7, published 18 Aug 2026) - [CVE-2026-41230: Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()](https://junglewise.ai/threats/cve-2026-41230-froxlor-has-a-bind-zone-file-injection-via-unsanitized-dns-record) (high, CVSS 8.5, published 23 Apr 2026) - [CVE-2026-52793: Froxlor's API Authentication bypasses 2FA Authentication](https://junglewise.ai/threats/cve-2026-52793-froxlor-s-api-authentication-bypasses-2fa-authentication) (high, CVSS 8.1, published 18 Aug 2026) - [CVE-2026-41234: Froxlor BIND zone file injection in DomainZones API TXT records](https://junglewise.ai/threats/cve-2026-41234-froxlor-bind-zone-file-injection-in-domainzones-api-txt-records) (high, CVSS 7.6, published 4 Jun 2026) - [CVE-2026-41231: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron](https://junglewise.ai/threats/cve-2026-41231-froxlor-has-incomplete-symlink-validation-in-datadump-add-allows) (high, CVSS 7.5, published 23 Apr 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 3 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 6 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "froxlor/froxlor (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/froxlor-froxlor, 12 November 2026.