Description
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| froxlor | froxlor | 2.0.0 – < 2.3.14 | 2.3.14 |
Advisories 1
- WID-SEC-2026-3629 Froxlor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
References
- GitHub Security Advisory (GHSA-3jpp-mhvh-rv66) vendor-advisory
- VulnCheck Advisory: Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value third-party-advisory