CVE-2026-109960

HIGH 7.7

Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.

CWE	CWE-79
Vendor	froxlor
Product	froxlor
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for froxlor froxlor

Be the first to know when new high vulnerabilities affecting froxlor froxlor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

froxlor / froxlor

2.0.0 < 2.3.14

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/froxlor/froxlor/security/advisories/GHSA-3jpp-mhvh-rv66 vulncheck.com: https://www.vulncheck.com/advisories/froxlor-2.0.0-before-2.3.14-stored-xss-via-customer-theme-value

Credits

🔍 manus-pi 🔍 manus-use