{"action":"Upgrade froxlor/froxlor to 2.3.7 or later.","affected":[{"fixed":"2.3.7","introduced":"0"}],"component":"froxlor/froxlor","cve_ids":["CVE-2026-90935"],"ecosystem":"Packagist","epss":0.00295,"exploited":false,"fixed_versions":["2.3.7"],"ghsa_id":"GHSA-q4rm-m6xh-5pv7","id":"tcs_01M5KF6Y3SP10Y1JYPZ85J8G7A","modified_at":"2026-09-15T03:56:00.268778886Z","published_at":"2026-07-02T19:23:49Z","references":["https://osv.dev/vulnerability/GHSA-q4rm-m6xh-5pv7","https://github.com/froxlor/froxlor/security/advisories/GHSA-q4rm-m6xh-5pv7","https://github.com/froxlor/froxlor"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-q4rm-m6xh-5pv7","url":"https://osv.dev/vulnerability/GHSA-q4rm-m6xh-5pv7"}],"summary":"Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API"}