CVE-2026-27502
SVXportal <= 2.5 log.php Search Reflected XSS
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal session data, perform actions as the victim, or modify displayed content.
| CWE | CWE-79 |
| Vendor | sa2blv |
| Product | svxportal |
| Published | Feb 20, 2026 |
| Last Updated | Feb 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for sa2blv svxportal
Be the first to know when new medium vulnerabilities affecting sa2blv svxportal are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
sa2blv / SVXportal
0 ≤ 2.5
References
Credits
philopentest