HTML Injection in Froxlor

MEDIUM 6.1CVE-2020-29653 · GHSA-j739-gw6q-f4c7 · Published 13/04/2022 · updated 17/06/2026

In short

CVE-2020-29653 is a MEDIUM (CVSS 6.1) vulnerability affecting froxlor/froxlor, froxlor (froxlor).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
froxlor/froxlor Packagist	`≤ 0.10.22`	No fix yet
froxlor froxlor	`≤ 0.10.22`	No fix yet

Description

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-29653 · ADVISORY
Froxlor/Froxlor commit 6bf5ecc · WEB
Froxlor/Froxlor · PACKAGE
Froxlor/Froxlor security advisory · WEB
nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup · WEB
Froxlor/Froxlor · Patch
nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup · Exploit

More vulnerabilities in froxlor/froxlor

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

froxlor/froxlor

Packagist

≤ 0.10.22

No fix yet

froxlor

≤ 0.10.22

No fix yet

Description

Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.

NVD description

More vulnerabilities in froxlor/froxlor

See all →