{"id":29800,"date":"2026-09-27T00:31:43","date_gmt":"2026-09-26T16:31:43","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100720"},"modified":"2026-09-27T00:31:43","modified_gmt":"2026-09-26T16:31:43","slug":"cve-2026-100720","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100720","title":{"rendered":"CVE-2026-100720 [HIGH] &#8211; Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer"},"content":{"rendered":"<p>Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()\/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer[&#8216;O&#8217;]) value verbatim without sanitization. Froxlor&#8217;s table-listing renderer then emits scalar cells through Twig&#8217;s `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains &gt; SSL certificates the attacker-supplied issuer value executes as script in the privileged user&#8217;s session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29800","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29800","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29800"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29800"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29800"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}