https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:20:15 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55593 <p><strong>Affected:</strong> froxlor</p> <p>Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator&#39;s browser to submit a forged request that adds an attacker-controlled address to an API key&#39;s allowed_from list or removes its expiration, weakening the key&#39;s security restrictions. This issue is fixed in version 2.3.8.</p> <p><strong>Affected:</strong> froxlor</p> <p>Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator&#39;s browser to submit a forged request that adds an attacker-controlled address to an API key&#39;s allowed_from list or removes its expiration, weakening the key&#39;s security restrictions. This issue is fixed in version 2.3.8.</p> https://vulnerability.circl.lu/vuln/cve-2026-55593