A stored cross‑site scripting flaw in Froxlor allows an authenticated customer to insert arbitrary HTML and JavaScript into the theme value through a form in customer_index.php. When an administrator later views the customer overview with the theme column enabled, the injected script runs inside the administrator’s browser. The script can then abuse the intranet CSRF token to create new administrator accounts or modify server‑wide settings, effectively leading to unauthorized administrative control.

All Froxlor installations from version 2.0.0 up to but not including 2.3.14 are vulnerable. The flaw resides in the core Froxlor web application. Earlier releases such as 2.0.0 through 2.3.13 lack the patch, while versions 2.3.14 and later contain the fix.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is available and the issue is not listed in the CISA KEV catalog. The attack requires an authenticated customer to set a malicious theme value; thereafter the exploit is triggered when any administrator views the customer list with the theme column displayed. Because the script executes in the context of the administrator, privilege escalation is possible even though the initial attacker has only customer level access.