Froxlor versions 2.0.0 through 2.3.10 contain a stored cross-site scripting (XSS) vulnerability. This occurs when a customer uploads an SSL certificate, and the issuer organization field is stored without sanitization. The vulnerability allows attacker-supplied script to execute in the session of privileged users such as administrators or resellers. Exploitation can lead to full administrator account takeover and potential root command execution on the managed server. The issue is resolved in Froxlor version 2.3.12.