This issue arises from an unescaped HTML field when a customer creates a DNS TXT record. The stored payload is rendered without escaping in the administration panel, so a malicious script runs in the administrator’s browser. The result is that an attacker who can manage DNS zones can steal or manipulate an administrator’s session, potentially allowing privileged actions such as credential theft or further exploitation. The weakness is stored cross‑site scripting (CWE‑79).

Froxlor server administration software is affected. Versions before 2.3.8 are vulnerable; the fix is included in release 2.3.8 and later.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an authenticated customer with DNS editor rights, who then stores a malicious script in a TXT record. When an administrator later views that DNS configuration, the JavaScript executes automatically in the admin’s browser session, giving the attacker the same privileges as the administrator. Because a content manage role is required, attackers must have access to the backend before exploiting the XSS.