Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on.....
9.6CVSS
5.6AI Score
0.0004EPSS
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to...
9.9CVSS
8.7AI Score
0.001EPSS
Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements.....
7.5CVSS
7.4AI Score
0.001EPSS
5.5CVSS
5AI Score
0.001EPSS
3.8CVSS
3.7AI Score
0.0004EPSS
5.3CVSS
5.1AI Score
0.001EPSS
7.5CVSS
7.5AI Score
0.001EPSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to...
6.2CVSS
4.9AI Score
0.001EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to...
5.4CVSS
4.7AI Score
0.0004EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to...
4.8CVSS
4.8AI Score
0.0004EPSS
5.4CVSS
5.6AI Score
0.001EPSS
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to...
7.2CVSS
7.1AI Score
0.001EPSS
5.4CVSS
4.8AI Score
0.001EPSS
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to...
9.8CVSS
9.5AI Score
0.002EPSS
7.2CVSS
6.6AI Score
0.001EPSS
Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to...
7.5CVSS
6.9AI Score
0.001EPSS
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to...
8.8CVSS
8.7AI Score
0.001EPSS
8.8CVSS
7.8AI Score
0.54EPSS
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to...
9.8CVSS
9.5AI Score
0.002EPSS
8.8CVSS
7.2AI Score
0.001EPSS
8.8CVSS
9.2AI Score
0.001EPSS
8.8CVSS
9.4AI Score
0.001EPSS
5.5CVSS
5.8AI Score
0.0004EPSS
4.3CVSS
4.6AI Score
0.001EPSS
4.3CVSS
4.6AI Score
0.001EPSS
6.1CVSS
6.4AI Score
0.001EPSS
4.6CVSS
4.9AI Score
0.001EPSS
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current...
7.5CVSS
7.6AI Score
0.002EPSS
6.5CVSS
6.5AI Score
0.001EPSS
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML...
6.1CVSS
6.4AI Score
0.001EPSS
Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input...
5.4CVSS
5.4AI Score
0.001EPSS
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB...
9.8CVSS
9.6AI Score
0.006EPSS
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of _createUserdataConf in...
6.1CVSS
5.9AI Score
0.0004EPSS
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in...
8.8CVSS
8.8AI Score
0.005EPSS
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...
5.5CVSS
5.1AI Score
0.0004EPSS
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability...
7.2CVSS
7.5AI Score
0.003EPSS
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading...
9.8CVSS
9.4AI Score
0.007EPSS
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a...
9.8CVSS
9.4AI Score
0.004EPSS