Vulnerability · Published Jan 27, 2026 · Assigned by VulnCheck
CVE-2020-36978Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting
Medium 6.4
In plain English
A medium-severity cross-site scripting in Froxlor Froxlor Server Management Panel from Froxlor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.3%top 72.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators view customer traffic modules.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Froxlor | Froxlor Froxlor Server Management Panel | 0.10.16 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- ExploitDB-49063 exploit
- Official Froxlor Homepage product
- Froxlor Download Page product
- Vulnerability Lab Advisory vendor-advisory
- Vulnerability Lab Profile vendor-advisory
- Researcher Profile vendor-advisory
- VulnCheck Advisory: Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting third-party-advisory