CVE-2026-109960: high-severity vulnerability in froxlor
Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected products
froxlor · froxlorRelated CVEs — froxlor
In the same product, most dangerous first.
CVE-2026-54348HIGHFroxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationEPSS 0.7%CVE-2026-113678CRITICALFroxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic CronEPSS 0.6%CVE-2026-62988CRITICALFroxlor: Credential and 2FA secret disclosure via Froxlor API endpointsEPSS 0.6%CVE-2026-30932HIGHFroxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIEPSS 0.6%CVE-2026-100714CRITICALFroxlor before 2.3.12 Command Injection via letsencryptchallengepathEPSS 0.5%CVE-2026-41228CRITICALFroxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code ExecutionEPSS 0.5%