CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows…
- Risk score
- 50/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attacker…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.3.14 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
Original description
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
Last activity 13 Oct 2026. Patch Forecast updates every hour.