CVE-2026-109960 in Froxlor
Summary
by MITRE • 10/13/2026
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The software Froxlor version 2.0.0 prior to release 2.3.14 is affected by a stored cross-site scripting vulnerability that stems from insufficient input validation and sanitization of user-supplied data within the customer interface. Specifically, the application fails to properly neutralize special characters when processing theme configuration values submitted through the customer_index.php endpoint. This flaw allows authenticated customers with access to this module to inject malicious HTML and JavaScript code into the database by setting a crafted value for the theme parameter. Because the input is stored server-side without adequate encoding or filtering, the payload persists in the system's data store rather than being executed immediately upon submission.
The operational impact of this vulnerability is significantly amplified because the injected script does not execute on the customer's own browser but instead triggers when an administrator views a specific administrative page. When an administrator accesses the customer overview interface with the Theme column enabled, the application retrieves and renders the stored theme value directly into the HTML response without proper context-aware escaping. This execution environment allows the malicious JavaScript to run within the security context of the administrator's session. Consequently, attackers can exploit this trust relationship to perform actions that are typically restricted to privileged users. The attacker gains the ability to abuse the administrative CSRF token mechanism, which facilitates unauthorized state-changing requests on behalf of the victim administrator.
This capability enables severe consequences including the creation of new administrator accounts with full system privileges or the modification of critical server settings. By manipulating these configurations, an adversary can potentially compromise the integrity and availability of the hosting control panel infrastructure. The vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting flaw. Furthermore, from a tactical perspective, this attack vector corresponds to ATT&CK technique T1059, specifically involving command or script interpretation via browser-based execution, and leverages the principle of privilege escalation by exploiting session management weaknesses inherent in the administrative interface's rendering logic.
To mitigate this vulnerability, it is imperative that all software instances running Froxlor versions earlier than 2.3.14 be updated to the latest patched release where input validation has been strengthened. For systems that cannot immediately upgrade, administrators should ensure that output encoding is applied rigorously whenever user-supplied data is rendered in HTML contexts, particularly within table columns or dynamic content areas. Implementing strict Content Security Policy headers can also help mitigate the impact of any remaining script injection attempts by restricting the sources from which scripts are allowed to execute. Additionally, reviewing and rotating administrative credentials after a suspected compromise is essential to ensure that no unauthorized accounts were created during the exploitation window.