CVE-2026-27506
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow. Authenticated users can inject malicious HTML/JavaScript into fields such as Firstname, lastname, email, and image_url, which are later rendered without adequate output encoding in the administrator interface, resulting in JavaScript execution in an administrator's browser.
Risk Assessment
The risk involves potential session hijacking, data theft, or unauthorized actions in the system by an attacker with a user account.
Recommendation
Immediately update SVXportal to a version newer than 2.5 that includes a fix for this vulnerability. Until the update is applied, restrict access to the admin panel and manually validate and sanitize input data.
Original NVD description (English source)
SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow (user_settings.php submitting to admin/update_user.php). Authenticated users can store malicious HTML/JavaScript in fields such as Firstname, lastname, email, and image_url, which are later rendered without adequate output encoding in the administrator interface (admin/users.php), resulting in JavaScript execution in an administrator's browser when the affected page is viewed.