CVE-2026-27503
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing attacker-supplied JavaScript to execute in the administrator's browser.
Risk Assessment
The risk for the organization includes session theft, administrative action forgery, and other browser-based attacks in the context of an admin user, potentially leading to full system compromise.
Recommendation
Immediately update SVXportal to a version later than 2.5 that includes the fix. Until then, restrict access to the admin panel and implement server-side filtering of the search parameter.
Other vulnerabilities in SVXportal
See all- CVE-2026-27506Medium
SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow. Authenticated users can inject malicious HTML/JavaScript into fields such as Firstname, lastname, email, and image_url, which are later rendered without adequate output encoding in the administrator interface, resulting in JavaScript execution in an administrator's browser.
- CVE-2026-27505Medium
Stored XSS vulnerability in SVXportal 2.5 and prior. An unauthenticated attacker can inject arbitrary JavaScript via user registration fields (firstname, lastname, email), which executes in an administrator's browser when viewing the user list.
- CVE-2026-27504Medium
SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in radiomobile_front.php via the stationid query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value into a hidden input value field, allowing attacker-supplied script injection and execution in the administrator's browser.
- CVE-2026-27502Medium
SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL.
Original NVD description (English source)
SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing attacker-supplied JavaScript to execute in the administrator's browser. This can enable session theft, administrative action forgery, or other browser-based compromise in the context of an admin user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS