https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 12:38:14 +0000 https://cve.radiocsirt.org/vuln/cve-2026-54347 <p><strong>Affected:</strong> froxlor</p> <p>Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. When an administrator views the affected domain&#39;s DNS configuration, the payload executes automatically in the administrator&#39;s browser session, which can expose session data or perform privileged panel actions. This issue is fixed in version 2.3.8.</p> <p><strong>Affected:</strong> froxlor</p> <p>Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. When an administrator views the affected domain&#39;s DNS configuration, the payload executes automatically in the administrator&#39;s browser session, which can expose session data or perform privileged panel actions. This issue is fixed in version 2.3.8.</p> https://cve.radiocsirt.org/vuln/cve-2026-54347