The Froxlor open-source server administration software has multiple security vulnerabilities in versions prior to 2.3.6 that could allow unauthorized actions such as creating arbitrary DNS records and accessing unauthorized language files.

🚨 EUVD-2026-25176 📊 Score: 10.0/10 (CVSS v3.1) 📦 Product: Froxlor 🏢 Vendor: froxlor 📅 Updated: 2026-04-23 📝 Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against the list of available language files. An authenticated cu... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25176 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-25178 📊 Score: 9.1/10 (CVSS v3.1) 📦 Product: Froxlor 🏢 Vendor: froxlor 📅 Updated: 2026-04-23 📝 Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25178 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-25180 📊 Score: 8.5/10 (CVSS v3.1) 📦 Product: Froxlor 🏢 Vendor: froxlor 📅 Updated: 2026-04-23 📝 Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25180 #cybersecurity #infosec #euvd #cve #vulnerability