# Froxlor vulnerabilities Source: https://junglewise.ai/threats/technologies/froxlor Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/froxlor.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 43 vulnerabilities in Froxlor: 0 in the last 7 days and 33 in the last 90 days, 9 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121436, was published on 3 November 2026. 10 vulnerabilities in the last four weeks, down 41% on the four before (17). 1 critical against 5. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 33 - All time: 43 (9 critical, 0 exploited in the wild) ## About Froxlor Froxlor is a web server control panel for managing hosting accounts and server configuration. ## Latest Froxlor vulnerabilities - [CVE-2026-121436: Froxlor information disclosure in API keys listing](https://junglewise.ai/threats/cve-2026-121436-froxlor-from-2-3-8-before-2-3-15-contains-an-information) (high, CVSS 7.2, published 3 Nov 2026) - [CVE-2026-121435: Froxlor authorization bypass in Mysqls.add API](https://junglewise.ai/threats/cve-2026-121435-froxlor-before-2-3-15-contains-an-authorization-bypass) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-121434: Froxlor Certificates API authorization bypass in Let's Encrypt management](https://junglewise.ai/threats/cve-2026-121434-froxlor-2-3-0-before-2-3-15-contains-a-missing-authorization) (medium, CVSS 5.4, published 3 Nov 2026) - [CVE-2026-113678: Froxlor symlink following in Statistics::makeChownWithNewStats](https://junglewise.ai/threats/cve-2026-113678-froxlor-before-2-3-15-contains-a-symlink-following-vulnerability) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-113677: Froxlor missing authorization in SubDomains.delete API](https://junglewise.ai/threats/cve-2026-113677-froxlor-from-0-10-0-before-2-3-15-contains-a-missing) (medium, CVSS 5.4, published 20 Oct 2026) - [CVE-2026-113676: Froxlor authorization bypass in Admins.get API](https://junglewise.ai/threats/cve-2026-113676-froxlor-from-0-10-0-before-2-3-15-contains-an-authorization) (medium, CVSS 4.3, published 20 Oct 2026) - [CVE-2026-109963: Froxlor insecure direct object reference in email template editor](https://junglewise.ai/threats/cve-2026-109963-froxlor-before-2-3-14-contains-an-insecure-direct-object) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-109962: Froxlor missing authorization in MySQL server and cronjob API](https://junglewise.ai/threats/cve-2026-109962-froxlor-0-10-0-before-2-3-14-contains-a-missing-authorization) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-109961: Froxlor newline injection in Ftps.add API group database](https://junglewise.ai/threats/cve-2026-109961-froxlor-0-10-0-before-2-3-14-contains-a-newline-injection) (high, CVSS 8.5, published 13 Oct 2026) - [CVE-2026-109960: Froxlor stored cross-site scripting in theme field](https://junglewise.ai/threats/cve-2026-109960-froxlor-2-0-0-before-2-3-14-contains-a-stored-cross-site) (high, CVSS 7.7, published 13 Oct 2026) - [CVE-2026-100720: Froxlor stored cross-site scripting in SSL certificate issuer](https://junglewise.ai/threats/cve-2026-100720-froxlor-2-0-0-through-2-3-10-is-vulnerable-to-stored-cross-site) (high, CVSS 8.7, published 26 Sep 2026) - [CVE-2026-100719: Froxlor credential disclosure in DirProtections.listing API](https://junglewise.ai/threats/cve-2026-100719-froxlor-versions-before-2-3-12-contain-a-credential-disclosure) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-100718: Froxlor API policy bypass in EmailSender.add](https://junglewise.ai/threats/cve-2026-100718-froxlor-through-2-3-10-does-not-enforce-the-mail-allow-external) (high, CVSS 7.1, published 26 Sep 2026) - [CVE-2026-100717: froxlor CRLF injection in subdomain redirect validation](https://junglewise.ai/threats/cve-2026-100717-froxlor-is-a-server-administration-panel-in-versions-2-3-10-and) (critical, CVSS 9.9, published 26 Sep 2026) - [CVE-2026-100716: Froxlor server administration panel symlink path traversal privilege escalation](https://junglewise.ai/threats/cve-2026-100716-froxlor-is-a-server-administration-panel-in-versions-2-3-10-and) (critical, CVSS 9.9, published 26 Sep 2026) - [CVE-2026-100715: Froxlor arbitrary file deletion via symlink following in cron task](https://junglewise.ai/threats/cve-2026-100715-froxlor-through-2-3-10-is-vulnerable-to-arbitrary-file-deletion) (critical, CVSS 9.6, published 26 Sep 2026) - [CVE-2026-100714: Froxlor argument injection in Let's Encrypt challenge path setting](https://junglewise.ai/threats/cve-2026-100714-froxlor-before-2-3-12-does-not-restrict-or-escape-the-system) (critical, CVSS 9.1, published 26 Sep 2026) - [CVE-2026-100713: Froxlor SSH key synchronization race condition leading to root access](https://junglewise.ai/threats/cve-2026-100713-froxlor-2-3-10-and-earlier-contain-a-time-of-check-time-of-use) (high, CVSS 7.8, published 26 Sep 2026) - [CVE-2026-100712: froxlor two-factor authentication disable via CSRF GET request](https://junglewise.ai/threats/cve-2026-100712-froxlor-through-2-3-10-disables-a-user-s-two-factor) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-100711: froxlor session invalidation bypass on password change](https://junglewise.ai/threats/cve-2026-100711-froxlor-versions-before-2-3-12-fail-to-invalidate-existing-panel) (high, CVSS 7.5, published 26 Sep 2026) - [CVE-2026-100710: Froxlor information disclosure of DKIM private key via API](https://junglewise.ai/threats/cve-2026-100710-froxlor-through-2-3-10-does-not-filter-sensitive-columns-from) (medium, CVSS 4.9, published 26 Sep 2026) - [CVE-2026-100709: Froxlor TOTP bypass via 2FA token namespace confusion](https://junglewise.ai/threats/cve-2026-100709-froxlor-through-2-3-10-stores-only-a-numeric-user-id-in) (high, CVSS 7.5, published 26 Sep 2026) - [CVE-2026-100708: Froxlor information disclosure in Certificates API](https://junglewise.ai/threats/cve-2026-100708-froxlor-before-2-3-13-returns-the-ssl-key-file-column-which) (high, CVSS 7.1, published 26 Sep 2026) - [CVE-2026-90937: froxlor CRLF injection in subdomain redirect URLs](https://junglewise.ai/threats/cve-2026-90937-froxlor-crlf-injection-in-subdomain-redirect-urls) (critical, CVSS 9.9, published 14 Sep 2026) - [CVE-2026-90936: Froxlor information disclosure in sender alias lookups](https://junglewise.ai/threats/cve-2026-90936-froxlor-information-disclosure-in-sender-alias-lookups) (medium, CVSS 4.3, published 14 Sep 2026) ## Most severe Froxlor vulnerabilities - [CVE-2026-41228: Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution](https://junglewise.ai/threats/cve-2026-41228-froxlor-has-local-file-inclusion-via-path-traversal-in-api-def) (critical, CVSS 9.9, published 23 Apr 2026) - [CVE-2026-90937: froxlor CRLF injection in subdomain redirect URLs](https://junglewise.ai/threats/cve-2026-90937-froxlor-crlf-injection-in-subdomain-redirect-urls) (critical, CVSS 9.9, published 14 Sep 2026) - [CVE-2026-113678: Froxlor symlink following in Statistics::makeChownWithNewStats](https://junglewise.ai/threats/cve-2026-113678-froxlor-before-2-3-15-contains-a-symlink-following-vulnerability) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-100717: froxlor CRLF injection in subdomain redirect validation](https://junglewise.ai/threats/cve-2026-100717-froxlor-is-a-server-administration-panel-in-versions-2-3-10-and) (critical, CVSS 9.9, published 26 Sep 2026) - [CVE-2026-100716: Froxlor server administration panel symlink path traversal privilege escalation](https://junglewise.ai/threats/cve-2026-100716-froxlor-is-a-server-administration-panel-in-versions-2-3-10-and) (critical, CVSS 9.9, published 26 Sep 2026) - [CVE-2026-100715: Froxlor arbitrary file deletion via symlink following in cron task](https://junglewise.ai/threats/cve-2026-100715-froxlor-through-2-3-10-is-vulnerable-to-arbitrary-file-deletion) (critical, CVSS 9.6, published 26 Sep 2026) - [CVE-2026-41229: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)](https://junglewise.ai/threats/cve-2026-41229-froxlor-has-a-php-code-injection-via-unescaped-single-quotes-in) (critical, CVSS 9.1, published 23 Apr 2026) - [CVE-2026-100714: Froxlor argument injection in Let's Encrypt challenge path setting](https://junglewise.ai/threats/cve-2026-100714-froxlor-before-2-3-12-does-not-restrict-or-escape-the-system) (critical, CVSS 9.1, published 26 Sep 2026) - [CVE-2026-62988: Froxlor API credential and 2FA secret disclosure](https://junglewise.ai/threats/cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure) (critical, CVSS 9, published 18 Aug 2026) - [CVE-2026-41236: Froxlor privilege escalation via symlink following in SSH key sync](https://junglewise.ai/threats/cve-2026-41236-froxlor-privilege-escalation-via-symlink-following-in-ssh-key) (high, CVSS 8.8, published 4 Jun 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, down 41% on the four before (17). 1 critical against 5. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 5 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 4 | 1 | 0 | | 21 Sep 2026 | 13 | 4 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 3 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Froxlor vulnerabilities", https://junglewise.ai/threats/technologies/froxlor, 13 November 2026.