PT-2026-111555

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer index.php. Script executes when an administrator views the customer overview with the Theme column...

PT-2026-99383

Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12 Description An issue exists where two-factor authentication 2FA is disabled immediately upon a GET request to the 2FA management page, such as the endpoint '/customer index.php?page=2fa&action=delete'. This...