{"action":"Upgrade froxlor/froxlor to 2.3.8 or later.","affected":[{"fixed":"2.3.8","introduced":"0"}],"component":"froxlor/froxlor","cve_ids":["CVE-2026-54348"],"ecosystem":"Packagist","epss":0.00655,"exploited":false,"fixed_versions":["2.3.8"],"ghsa_id":"GHSA-w27m-rmmf-g5w4","id":"tcs_01M5KF9KYE6MT8CFSMMJBDZKET","modified_at":"2026-08-18T21:11:08.669909Z","published_at":"2026-08-18T20:47:59Z","references":["https://osv.dev/vulnerability/GHSA-w27m-rmmf-g5w4","https://github.com/froxlor/froxlor/security/advisories/GHSA-w27m-rmmf-g5w4","https://github.com/froxlor/froxlor/commit/a1eaca5a1601c8a30e00814a4fc73ad0c185f89e","https://github.com/froxlor/froxlor","https://github.com/froxlor/froxlor/releases/tag/2.3.8"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-w27m-rmmf-g5w4","url":"https://osv.dev/vulnerability/GHSA-w27m-rmmf-g5w4"}],"summary":"Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration"}