CVE-2020-36978

Published: Jan 27, 2026Modified: Jun 17, 2026Deferred

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators view customer traffic modules.

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

https://froxlor.org/

Source: disclosure@vulncheck.com

https://froxlor.org/download/

Source: disclosure@vulncheck.com

https://www.exploit-db.com/exploits/49063

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/froxlor-froxlor-server-management-panel-persistent-cross-site-scripting

Source: disclosure@vulncheck.com

https://www.vulnerability-lab.com/get_content.php?id=2241

Source: disclosure@vulncheck.com

https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.

Source: disclosure@vulncheck.com

https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab

Source: disclosure@vulncheck.com

https://www.exploit-db.com/exploits/49063

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.