high7.7
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a…
Impact
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
Affected products
| Product | Affected versions |
|---|---|
| Froxlor 2.0.0 | before 2.3.14 |
Versions were read from the advisory text. No structured product data has been published for this record yet.