Answer in brief
CVE-2026-54347 records a High severity (CVSS 8.7) vulnerability in Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover. The current sources do not mark it as known exploited. The current feed maps froxlor/froxlor (composer), froxlor/froxlor (generic), froxlor/froxlor (packagist). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps froxlor/froxlor (composer), froxlor/froxlor (generic), froxlor/froxlor (packagist). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| froxlor/froxlorcomposer | <=2.3.7 | 2.3.8 |
| froxlor/froxlorgeneric | < 2.3.8 | Not reported |
| froxlor/froxlorpackagist | >=0 <2.3.8 | 2.3.8 |
Published upstream
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 18, 2026
Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. When an administrator views the affected domain's DNS configuration, the payload executes automatically in the administrator's browser session, which can expose session data or perform privileged panel actions. This issue is fixed in version 2.3.8.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-54347 records a High severity (CVSS 8.7) vulnerability in Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover. The current sources do not mark it as known exploited. The current feed maps froxlor/froxlor (composer), froxlor/froxlor (generic), froxlor/froxlor (packagist). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps froxlor/froxlor (composer), froxlor/froxlor (generic), froxlor/froxlor (packagist). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| froxlor/froxlorcomposer | <=2.3.7 | 2.3.8 |
| froxlor/froxlorgeneric | < 2.3.8 | Not reported |
| froxlor/froxlorpackagist | >=0 <2.3.8 | 2.3.8 |
Published upstream
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 18, 2026
Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. When an administrator views the affected domain's DNS configuration, the payload executes automatically in the administrator's browser session, which can expose session data or perform privileged panel actions. This issue is fixed in version 2.3.8.
Quoted source text, attributed separately from HOL analysis.