CVE-2026-100720 - Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
Brief
CVE ID : CVE-2026-100720
Published : Sept. 26, 2026, 2:16 p. m.
- 6 hours, 44 minutes ago
Description : Froxlor 2.
- 0 through 2.
- 10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization.
Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session.