repository icon
froxlor / froxlor Project repository

The server administration software for your needs - The official Froxlor development Git repository

Submit a report

FIRST INTERACTION

WITHIN1 DAY

REVIEW

WITHIN11 DAYS

FIX

WITHIN23 DAYS

Absence of rate limit on "API-key" creation on admin login
th3l0newolf
not applicable
Privilege escalation via symbolic link
sro0
Critical
•$60•CVE-2023-6069
Stored HTML injection
huu-cuong
duplicate
Medium
SQL Database Error could lead to SQL Injection with internal Path Disclosure
huu-cuong
not applicable
Stored HTML injection
huu-cuong
duplicate
Medium
Stored HTML injection
amal03-bit
Medium
•CVE-2023-4829
HTML injection Leads to Open redirection
amal03-bit
Medium
•CVE-2023-5564
Business Logic Error - letting the Name Field blank
ahmedvienna
Low
•CVE-2023-4304
Uncaught Error while deleteing the default Backup File
ahmedvienna
not applicable
SQL Errors with multiple internal Path Disclosures while deleting a Backup File
ahmedvienna
not applicable
stored HTML Injection in the Backup Section
ahmedvienna
not applicable
Remote Command Execution by Improper Escaping of Output
mat4mee
Critical
•$60•CVE-2023-3668
Command Injection in "php-fpm restart command"
mat4mee
duplicate
High
Insufficient Session Expiration in https://demo.froxlor.org/
kaal-kali
self closed
PHPSESSID is not renewed after user login
uonghoangminhchau
duplicate
Low
File Path Traversal Vulnerability
1dayluo
Medium
•CVE-2023-3172
Using incorrect regex to filter OS command leads to RCE
nhiephon
duplicate
Critical
Froxlor Brute Force on Current Password Field Lead to Account Takeover Due to La...
phyowathonewin
duplicate
High
Authentication Bypass and Weakness security
panveanyy
informative
High
2FA Bypass by Brute Force
sro0
Critical
•$60•CVE-2023-3173
.Git file exposed.
lambardarr
informative
High
Remote Code Execution Vulnerability Through Unrestrict File Write
renhaot
Critical
•$60•CVE-2023-2034
Authentication Bypass for users with MD5 password hash
sro0
Critical
•$60•CVE-2023-1307
No Rate Limit On Reset Password
earth2sky
Medium
•CVE-2023-2666
Arbitrary File Deletion
blakduk
duplicate
High
Remote Code Execution in "Import Settings" feature
blakduk
Critical
•$60•CVE-2023-0877
html injection
nayefhmoodh
duplicate
Medium
Session Fixation in https://demo.froxlor.org/
dhina016
Medium
•CVE-2023-3192
CSRF in all endpoints of /lib/ajax.php by Changing the request method to GET
dhina016
Medium
•CVE-2023-1033
strong Password Policy Bypass through a Space
ahmedvienna
self closed
weak Password Policy Directory Protection
ahmedvienna
Medium
•CVE-2023-0564
Language Dropdown Menu Manipulation
ahmedvienna
Medium
•CVE-2023-0565
SQL Database Error could lead to SQL Injection with internal Path Disclosure
ahmedvienna
Medium
•CVE-2023-0572
Dropdown Menu Manipulation leads to stored HTML Injection
ahmedvienna
Medium
•CVE-2023-0566
Stored HTML Injection
ahmedvienna
informative
Medium
Privilege Escalation from customer to root
sro0
Critical
•$60•CVE-2023-0671
Froxlor 2.0.6 Remote Command Execution via Arbitrary File Write and Server Side...
mhaskar
High
•$30•CVE-2023-0315
Get based CSRF on Reset OP Cache functionality
leorac
Low
•CVE-2022-4867
Reseller role allowed to access to admin functionalities
leorac
Medium
•CVE-2022-4868
Authenticated HTMLi via theme parameter on /lib/ajax.php
leorac
Medium
•CVE-2022-4864
Client side restriction bypass on upload image file in settings
leorac
informative
Medium
Html injection on admin_settings.php through part parameter
leorac
informative
Medium
Local File Read through Improper Filename Validation
kos0ng
Medium
•CVE-2023-0316
Authenticated Unrestricted Import Settings Lead to RCE
kos0ng
not applicable
CSRF to change admin users password
uonghoangminhchau
informative
Medium
Improper validation in using of services commands
benasin
informative
High
Cron execution command field allows attackers with admin privilege to execute OS...
benasin
High
•$30
Unintended API key generation
7h3h4ckv157
Medium
froxlor/froxlor <= 0.10.38.2 - Authenticated Unrestricted File Upload to RCE
haidv35
High
Username and email enumeration via Forgot password feature
xanhacks
Medium
CSRF on SSL certificates deletion
xanhacks
High
Html Injection Reflected in Login Page
mike993
Medium
•CVE-2022-3869
Html Injection Stored in edit customers
sk4rl1ght
High
•CVE-2022-3721
CSRF on deleting an API key
victoni
Medium
•CVE-2022-3017
Use of a Broken or Risky Cryptographic Algorithm
michaellrowley
High
External Control of File Name or Path
melbinkm
High
•$25
Sensitive Cookie Without 'HttpOnly' Flag
melbinkm
Medium
•$25
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
melbinkm
Medium
•$25
huntr: froxlor/froxlor