ZeroDay Findings
Sign inSign up

Findings

CVE-2026-41229

Froxlor is open source server administration software.

Published Apr 23, 2026 · updated Jun 17, 2026 · froxlor froxlor

Froxlor is open source server administration software. Prior to version 2.3.6, writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with permission adds or updates a MySQL server via the API, the parameter (which has no input validation) is written unescaped into . Since this file is d on every request via , an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 23, 2026 · NIST NVD

    Detected

    Froxlor is open source server administration software. Prior to version 2.3.6, writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with permission adds or updates a MySQL server via the API, the parameter (which has no input validation) is written unescaped into . Since this file is d on every request via , an attacker can inject arbitrary PHP

  2. Jun 17, 2026 · NIST NVD

    Updated

    Froxlor is open source server administration software. Prior to version 2.3.6, writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with permission adds or updates a MySQL server via the API, the parameter (which has no input validation) is written unescaped into . Since this file is d on every request via , an attacker can inject arbitrary PHP

Affected

  • cpe froxlor/froxlorversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-41229

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-41229

    Froxlor is open source server administration software. Prior to version 2.3.6, writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with permission adds or updates a MyS

    nvd.nist.gov

References