CVE-2026-100715Proof of concept (PoC) published · CISA
Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
CVSS score
8.5
EPSS probability
%0.4
Risk score
0.0
Published
16 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.0
CVE-2026-62988
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
F
Patch verifiedEPSS %1
9.4
CVE-2026-100714
Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
F
Patch status unknownEPSS %1
7.2
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
F
Patch verifiedEPSS %1
9.4
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
F
Patch status unknownEPSS %0
9.4
CVE-2026-100716
Froxlor before 2.3.12 Privilege Escalation via Symlink
F
Patch status unknownEPSS %0
8.7
CVE-2026-54347
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
F
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-100715"