Medium severity · published Jan 27, 2026
CVE-2020-36978
Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators view customer traffic modules.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Froxlor Froxlor Server Management Panel · Froxlor
0.10.16 · source: vendor
Affected product
FF
Froxlor Froxlor Server Management Panel
Froxlor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36978
froxlor.org
https://froxlor.org/
froxlor.org
https://froxlor.org/download/
www.exploit-db.com
https://www.exploit-db.com/exploits/49063
www.vulncheck.com
https://www.vulncheck.com/advisories/froxlor-froxlor-server-management-panel-persistent-cross-site-scripting
www.vulnerability-lab.com
https://www.vulnerability-lab.com/get_content.php?id=2241
www.vulnerability-lab.com
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.