CVE-2025-48958: falha de média gravidade em Froxlor
Froxlor has an HTML Injection Vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.4%
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Produtos afetados
froxlor · FroxlorCVEs relacionadas — Froxlor
No mesmo produto, das mais perigosas para as menos.
CVE-2024-34070CRITICALFroxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromiseEPSS 1.0%CVE-2026-26279CRITICALFroxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command InjectionEPSS 0.9%CVE-2026-90767HIGHFroxlor before 2.3.12 SSH Key Injection via authorized_keysEPSS 0.4%CVE-2025-29773MEDIUMFroxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account TakeoverEPSS 0.3%