Froxlor CVE-2026-109960

Exploitation requires an authenticated Froxlor customer account (PR:L) able to set a theme value through customer_index.php, and critically depends on an administrator subsequently viewing the customer overview page with the Theme column enabled (UI:P / AT:P) - the payload is inert until that admin view occurs. Limiting factors: the attacker must first hold valid customer credentials, the Theme column must be enabled in the admin overview (not guaranteed in all deployments), and an administrator must actively browse the affected view for the script to fire against the admin session. Affected versions are Froxlor 2.0.0 up to but not including 2.3.14; upgrading to 2.3.14 removes the condition.

This is a credible but conditional priority rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P) scores 8.7 (High), with the elevation coming from subsequent-system impact (SC:H/SI:H) that reflects the XSS executing in the administrator's authenticated session to create admin accounts or alter server settings - effectively privilege escalation from customer to administrator. Several signals dampen real-world urgency: PR:L means the attacker must already hold a valid customer account, UI:P requires an administrator to actively view the customer overview with the (non-default) Theme column enabled, and AT:P indicates a specific attack prerequisite must be met. No EPSS score, KEV listing, or POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.7 reflects potential impact, not demonstrated weaponization. There are no conflicting signals in the CVSS data itself (network vector is consistent with a web-based stored XSS), but the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the inputs.

An attacker who has registered or compromised a low-privileged Froxlor customer account sets a malicious theme value via customer_index.php containing HTML/JavaScript. When an administrator later opens the customer overview with the Theme column enabled, the script runs in the admin's session and abuses the CSRF token to silently create a new administrator account or modify server settings. No public exploit code is identified in the provided data, so exploitation would require an attacker to craft the payload themselves.