CVE-2025-48958: medium-severity vulnerability in Froxlor
Froxlor has an HTML Injection Vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.4%
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
froxlor · FroxlorRelated CVEs — Froxlor
In the same product, most dangerous first.
CVE-2024-34070CRITICALFroxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromiseEPSS 1.0%CVE-2026-26279CRITICALFroxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command InjectionEPSS 0.9%CVE-2026-90767HIGHFroxlor before 2.3.12 SSH Key Injection via authorized_keysEPSS 0.4%CVE-2025-29773MEDIUMFroxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account TakeoverEPSS 0.3%