CVE-2023-4829: 
PHP vulnerability analysis and mitigation

A stored Cross-site Scripting (XSS) vulnerability was identified in GitHub repository froxlor/froxlor versions prior to 2.0.22. The vulnerability was assigned CVE-2023-4829 and was disclosed on October 13, 2023. The issue affects the Froxlor hosting control panel software (NVD).

The vulnerability has been assessed with a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The vulnerability stems from improper validation of input parameters (NVD).

The vulnerability allows attackers to execute malicious scripts in the context of the affected application, potentially leading to the compromise of user data and session information. The CVSS scoring indicates low confidentiality and integrity impacts, with no impact on availability (NVD).

The vulnerability has been patched in version 2.0.22 of Froxlor. Users are advised to upgrade to this version or later to mitigate the risk. The fix involves improving the validation of hostingplan name and description parameters (GitHub Patch).