Medium severity · published Apr 13, 2022
CVE-2020-29653
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter
6.1
CVSS
1.4%
EPSS
No
On KEV
Description
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Froxlor · Froxlor
through 0.10.22 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29653
Patch
https://github.com/Froxlor/Froxlor/commits/master
Not Applicable
https://github.com/Froxlor/Froxlor/security/advisories
Exploit
https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/
More from Froxlor
9.9
CVE-2026-113678
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
9.9
CVE-2026-100717
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
9.9
CVE-2026-100716
Froxlor before 2.3.12 Privilege Escalation via Symlink
9.9
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
9.9
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution