CVE-2026-109960
HIGH
NVD
CVSS Score
7.7
Severity
HIGH
Published
Oct 13, 2026
Vendor
unknown
Description
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.