CVE-2026-109960

Name of the Vulnerable Software and Affected Versions Froxlor versions 2.0.0 through 2.3.13

Description A stored cross-site scripting issue exists where authenticated customers can inject HTML and JavaScript. This occurs by providing a malicious value for the theme via the 'customer index.php' endpoint. The injected script executes when an administrator views the customer overview with the Theme column enabled, which can be used to abuse the CSRF (Cross-Site Request Forgery) token to create administrator accounts or modify server settings. CSRF is a technique where a user is tricked into executing unwanted actions on a web application in which they are currently authenticated.

Recommendations Update Froxlor to version 2.3.14 or later.