{"cve":"CVE-2025-29773","nvd":{"published":"2025-03-13T17:15:37.833","modified":"2026-06-17T09:05:38.800","status":"Analyzed","description":"Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin. The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues. Version 2.2.6 fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-287"],"references":["https://github.com/froxlor/Froxlor/commit/a43d53d54034805e3e404702a01312fa0c40b623","https://github.com/froxlor/Froxlor/security/advisories/GHSA-7j6w-p859-464f","https://mega.nz/file/h8oFHQrL#I4V02_BWee4CCx7OoBl_2Ufkd5Wc7fvs5aCatGApkoQ","https://github.com/froxlor/Froxlor/security/advisories/GHSA-7j6w-p859-464f"],"products":["froxlor:froxlor"],"source":"nvd","synced_at":"2026-10-19T22:00:17.429720821+00:00"},"epss":{"cve":"CVE-2025-29773","score":0.00289,"percentile":0.21502,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}