CVE-2025-29773

Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin. The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues. Version 2.2.6 fixes the issue.

• CWE-287

• https://github.com/froxlor/Froxlor/commit/a43d53d54034805e3e404702a01312fa0c40b623Patch
• https://github.com/froxlor/Froxlor/security/advisories/GHSA-7j6w-p859-464fExploit, Vendor Advisory
• https://mega.nz/file/h8oFHQrL#I4V02_BWee4CCx7OoBl_2Ufkd5Wc7fvs5aCatGApkoQExploit
• https://github.com/froxlor/Froxlor/security/advisories/GHSA-7j6w-p859-464fExploit, Vendor Advisory

Published

Mar 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29768Vim, a text editor, is vulnerable to potential data loss wit…4.4
• CVE-2025-29769libvips is a demand-driven, horizontally threaded image proc…5.5
• CVE-2025-2977A vulnerability was found in GFI KerioConnect 10.0.6. It has…5.4
• CVE-2025-29770vLLM is a high-throughput and memory-efficient inference and…6.5
• CVE-2025-29771HtmlSanitizer is a client-side HTML Sanitizer. Versions prio…5.3
• CVE-2025-29772OpenEMR is a free and open source electronic health records …6.1
• CVE-2025-29774xml-crypto is an XML digital signature and encryption librar…9.3
• CVE-2025-29775xml-crypto is an XML digital signature and encryption librar…9.3
• CVE-2025-29776Azle is a WebAssembly runtime for TypeScript and JavaScript …8.7
• CVE-2025-29778Kyverno is a policy engine designed for cloud native platfor…8
• CVE-2025-29779Post-Quantum Secure Feldman's Verifiable Secret Sharing prov…5.4
• CVE-2025-2978A vulnerability was found in WCMS 11. It has been rated as c…9.8