CVE-2025-48958

Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.

• CWE-79

• https://github.com/froxlor/Froxlor/commit/fde43f80600f1035e1e3d2297411b666d805549aPatch
• https://github.com/froxlor/Froxlor/security/advisories/GHSA-26xq-m8xw-6373Exploit, Vendor Advisory
• https://github.com/user-attachments/assets/86947633-3e7c-4e10-86cc-92e577761e8eExploit
• https://github.com/froxlor/Froxlor/security/advisories/GHSA-26xq-m8xw-6373Exploit, Vendor Advisory

Published

Jun 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48952NetAlertX is a network, presence scanner, and alert framewor…9.4
• CVE-2025-48953Umbraco is an ASP.NET content management system (CMS). Start…6.5
• CVE-2025-48954Discourse is an open-source discussion platform. Versions pr…6.1
• CVE-2025-48955Para is a multitenant backend server/framework for object pe…6.2
• CVE-2025-48956vLLM is an inference and serving engine for large language m…7.5
• CVE-2025-48957AstrBot is a large language model chatbot and development fr…7.5
• CVE-2025-48959Local privilege escalation due to insecure file permissions.…6.7
• CVE-2025-4896A vulnerability was found in Tenda AC10 16.03.10.13 and clas…7.5
• CVE-2025-48960Weak server key used for TLS encryption. The following produ…5.9
• CVE-2025-48961Local privilege escalation due to insecure folder permission…7.3
• CVE-2025-48962Sensitive information disclosure due to SSRF. The following …4.3
• CVE-2025-48963Local privilege escalation due to improper soft link handlin…7.3