CVE-2026-109962
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 13, 2026
Vendor
unknown
Description
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.