Most recent entries from all

EUVD-2026-5421

2026-10-08T13:55:23.340066+00:00

EUVD-2026-5421

fkie_cve-2024-34070

2026-10-08T13:55:23.340105+00:00

Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. This vulnerability is fixed in 2.1.9.

GHSA-x525-54hf-xr53 — Blind XSS Leading to Froxlor Application Compromise

2026-10-08T13:55:23.340151+00:00

Affected: Packagist: froxlor/froxlor

### Description:

A Stored Blind Cross-Site Scripting (XSS) vulnerability has been identified in the Failed Login Attempts Logging Feature of the Froxlor Application. Stored Blind XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. In this case, an unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs.

The application protects users against XSS attacks by utilizing an xss sanitization library. But the checks of the library were bypassed by crafting an XSS Payload using data binding and interpolation of Vue.js

A working XSS payload was crafted which forces an administrator to add a new malicious attacker-controlled Administrator User. The Payload is: [payload.txt](https://github.com/froxlor/Froxlor/files/15142616/payload.txt)

By exploiting this vulnerability, an unauthenticated attacker can force the Administrator to perform actions without the administrator even noticing anything suspicious. In one scenario, I made an exploit that forced the administrator to add an attacker-controlled Administrator into the Froxlor Application, resulting in a compromise of the Froxlor Application.

### Impact: The impact of this vulnerability is severe as it allows an attacker to compromise the Froxlor Application. By explo…

WID-SEC-W-2024-1169 — Froxlor: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

2026-10-08T13:55:23.340204+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Froxlor ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.