CVE-2026-109960
Deferred Deferred - Pending Action

Stored XSS in Froxlor Admin Panel via Malicious Theme Value

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109960
EUVD
EUVD-2026-98664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Froxlor versions 2.0.0 through 2.3.13. An authenticated customer can inject malicious HTML and JavaScript by setting a harmful theme value via customer_index.php. When an administrator views the customer overview with the Theme column enabled, the injected script executes in the administrator's session.

Detection Guidance

Check Froxlor version with: froxlor --version or via the web interface. Inspect customer accounts for unusual theme values in the database table froxlor_settings or froxlor_customers. Look for administrators reporting unexpected script execution when viewing customer lists with the Theme column enabled.

Impact Analysis

Attackers can exploit this to execute arbitrary JavaScript in an administrator's session. This may allow abuse of the administrator's CSRF token to create admin accounts, modify server settings, or change API keys, potentially leading to full host compromise.

Mitigation Strategies

Upgrade Froxlor to version 2.3.14 or later immediately. As a temporary measure, remove the Theme column from the customer overview in the admin panel. Ensure no customer accounts have custom theme values set.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109960. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart