CVE-2026-100720

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12.

• CWE-79

• https://github.com/froxlor/froxlor/security/advisories/GHSA-89vj-gqqr-73p8
• https://www.vulncheck.com/advisories/froxlor-before-2.3.12-stored-xss-via-ssl-certificate-issuer

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100715Froxlor through 2.3.10 is vulnerable to arbitrary file delet…9.6
• CVE-2026-100716Froxlor is a server administration panel. In versions 2.3.10…9.9
• CVE-2026-100717froxlor is a server administration panel. In versions 2.3.10…9.9
• CVE-2026-100718Froxlor through 2.3.10 does not enforce the mail.allow_exter…7.1
• CVE-2026-100719Froxlor versions before 2.3.12 contain a credential disclosu…6.5
• CVE-2026-10072DreamMaker developed by Interinfo has an Arbitrary File Uplo…8.6
• CVE-2026-10073DreamMaker developed by Interinfo has an Arbitrary File Read…8.7
• CVE-2026-100739A vulnerability was detected in mathurvishal CloudClassroom-…7.3
• CVE-2026-10074DreamMaker developed by Interinfo has an Arbitrary File Read…6.9
• CVE-2026-10075DreamMaker developed by Interinfo has a Path Traversal vulne…6.9
• CVE-2026-10077The yootheme WordPress theme before 5.0.35 does not prevent …6.8
• CVE-2026-10078A flaw was found in the Quay config-tool's GitLab OAuth vali…2.7