froxlor has 32 CVEs on record. Disclosure cadence is accelerating: 30 in the last 90 days against 2 in the 90 before. The busiest recent month was September 2026 with 18. The median CVSS is 7.2 (high), with 7 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-200 (6) and CWE-285 (3). Most affected products: froxlor (25), froxlor/froxlor (7).
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 30 prev 2
32
Total CVEs
7
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-113678Critical· 9.9Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron67CVE-2026-100716Critical· 9.9Froxlor is a server administration panel67CVE-2026-100715Critical· 9.6Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task65CVE-2026-109961High· 8.5Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.a…59CVE-2026-100717Critical· 9.9froxlor is a server administration panel55
froxlor vulnerabilities
CVEs affecting froxlor, newest first. Open any entry for full detail, references, and exploit status.
32 CVEsRSS
GHSA-mr9h-45p9-fg8hMedium· 4.3Froxlor: Authenticated customers can read other customers' allowed sender aliases
Froxlor: Authenticated customers can read other customers' allowed sender aliases
▾ Sunlitfroxlor · froxlor/froxlorvia GHSA
GHSA-q4rm-m6xh-5pv7Medium· 4.3Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
▾ Sunlitfroxlor · froxlor/froxlorvia GHSA