PT-2025-23501 · Froxlor · Froxlor

Benefactoryuvi · Published 2025-03-11 · Updated 2025-06-25 · CVE-2025-48958

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.2.6

Description The issue is an HTML Injection vulnerability in the customer account portal, allowing an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability can be exploited through user input without authentication.

Recommendations For versions prior to 2.2.6, update to version 2.2.6 to fix the issue. As a temporary workaround, consider restricting user input in the email section of the customer account portal to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-48958

GHSA-26XQ-M8XW-6373

Affected Products

Froxlor

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48958.json · Exploit
• 🔥 https://github.com/froxlor/Froxlor/security/advisories/GHSA-26xq-m8xw-6373 · Exploit
• 🔥❌ https://github.com/user-attachments/assets/86947633-3e7c-4e10-86cc-92e577761e8e · Exploit, Deleted
• https://github.com/froxlor/Froxlor/commit/fde43f80600f1035e1e3d2297411b666d805549a · Patch
• https://osv.dev/vulnerability/CVE-2025-48958 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26xq-m8xw-6373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48958 · Security Note
• https://github.com/froxlor/Froxlor · Note
• https://t.me/cvenotify/126660 · Telegram Post
• https://twitter.com/dailycve/status/1937947107362525547 · Twitter Post
• https://t.me/cvetracker/25169 · Telegram Post
• https://twitter.com/CVEnew/status/1929500866324967668 · Twitter Post
• https://t.me/cvenotify/124334 · Telegram Post
• https://t.me/cvenotify/124374 · Telegram Post