CVE-2026-109962

4.3 MEDIUMpublic exploit available

Published 2026-10-13 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-285

Public exploit & PoC references

https://github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8f
https://github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8f

All references

https://github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8f
https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.14-missing-authorization-in-mysqlserver-and-cronjobs-api
https://github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8f

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2023-54410PoC
HIGHCVE-2025-71426PoC
HIGHCVE-2026-10030
MEDIUMCVE-2026-100878PoC
HIGHCVE-2026-100885PoC
MEDIUMCVE-2026-100897
MEDIUMCVE-2026-101006
MEDIUMCVE-2026-102261PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.