CVE-2025-63725
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php.
Risk Assessment
An attacker can lure a victim into clicking a crafted link and execute malicious script in their browser, hijacking sessions or stealing credentials.
Recommendation
Update SVX Portal to a non-vulnerable version and implement validation and encoding of the id parameter in Recivers.php.
Other vulnerabilities in SVX Portal
See all- CVE-2025-63724Medium
SVX Portal 2.7A has a SQL injection (SQL-i) vulnerability via a crafted POST request to admin/update_setings.php.
- CVE-2025-61532Medium
A Cross Site Scripting (XSS) vulnerability in SVX Portal v.2.7A allows execution of arbitrary code via the TG parameter on the last_heard_page.php component.
Original NVD description (English source)
Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS