CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109960
HIGHCVSS 7.7NVD feed
Published 13 October 2026 · tracked since 14 October 2026
Description
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enable
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-65197 LOW 3.1
- CVE-2026-53418 HIGH 8.1
- CVE-2026-109521 HIGH 7.3
- CVE-2026-109522 HIGH 7.3
- CVE-2026-109523 HIGH 7.3
- CVE-2026-108184 HIGH 7.4
- CVE-2026-106108
- CVE-2026-107460
- CVE-2026-102342 MEDIUM 5.4
- CVE-2026-74036 HIGH 7.2