{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/froxlor-2.0.0-2.3.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-109960"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Froxlor (2.0.0-2.3.13)","Froxlor (\u003c 2.3.14)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","vulnerability","linux"],"_cs_type":"advisory","_cs_vendors":["Froxlor"],"content_html":"\u003cp\u003eFroxlor versions from 2.0.0 up to, but not including, 2.3.14 are susceptible to a stored cross-site scripting (XSS) vulnerability. The vulnerability resides in the \u003ccode\u003ecustomer_index.php\u003c/code\u003e component, where the application fails to properly sanitize the theme configuration value submitted by authenticated customers. An attacker with standard customer access can inject malicious HTML and JavaScript payloads into their theme settings. When an administrator subsequently views the customer overview page with the 'Theme' column enabled, the payload executes within the context of the administrator's session. This allows the attacker to perform actions as the administrator, including creating new unauthorized administrator accounts or altering sensitive server configurations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for complete takeover of the administrative interface. Attackers can escalate privileges by creating new administrator accounts or modify underlying server settings, potentially leading to total system compromise. This vulnerability specifically affects environments hosting multiple customers where standard user accounts are accessible to the attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Froxlor to version 2.3.14 or later immediately to patch the input sanitization flaw in \u003ccode\u003ecustomer_index.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor administrative access logs for suspicious account creation or configuration changes performed shortly after viewing the customer overview module.\u003c/li\u003e\n\u003cli\u003eRestrict administrative access to the customer overview page until the patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T14:39:16Z","date_published":"2026-10-13T14:39:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-froxlor-xss/","summary":"Froxlor versions 2.0.0 through 2.3.13 are vulnerable to stored cross-site scripting (XSS) via the customer theme setting, allowing authenticated customers to compromise administrator sessions.","title":"Stored XSS in Froxlor via Malicious Theme Configuration","url":"https://feed.craftedsignal.io/briefs/2026-10-froxlor-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Froxlor (2.0.0-2.3.13)","version":"https://jsonfeed.org/version/1.1"}