Medium severity6.5NVD Advisory· Published Sep 26, 2026· Updated Sep 26, 2026
CVE-2026-100719
CVE-2026-100719
Description
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.