CVE-2026-54347: Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

A stored Cross-Site Scripting (XSS) vulnerability in Froxlor’s DNS editor allows an authenticated user with DNS editor access (customer role) to inject arbitrary JavaScript into any administrator’s browser session. When an administrator views the DNS configuration of an affected domain, the payload executes automatically — enabling complete admin account takeover, credential theft, and full server compromise.