CVE-2026-27505
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Stored XSS vulnerability in SVXportal 2.5 and prior. An unauthenticated attacker can inject arbitrary JavaScript via user registration fields (firstname, lastname, email), which executes in an administrator's browser when viewing the user list.
Risk Assessment
Risk of session hijacking, data theft, or unauthorized actions in the admin panel, potentially leading to full system compromise.
Recommendation
Upgrade SVXportal to version 2.6 or later immediately. Until patched, restrict admin panel access and implement output encoding for user-supplied data.
Original NVD description (English source)
SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user registration workflow (index.php submitting to admin/user_action.php). User-supplied fields such as Firstname, lastname, and email are stored in the backend database without adequate output encoding and are later rendered in the administrator interface (admin/users.php), allowing an unauthenticated remote attacker to inject arbitrary JavaScript that executes in an administrator's browser upon viewing the affected page.