CVE-2026-27502

MEDIUM

6.1

Beschreibung

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal session data, perform actions as the victim, or modify displayed content.

CVE Details

CVSS v3.1 Bewertung6.1

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht2/20/2026

Zuletzt geandert2/23/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

radioinorr:svxportal

Schwachen (CWE)

CWE-79

Referenzen

https://github.com/sa2blv/SVXportal/blob/master/log.php(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/svxportal-log-php-search-reflected-xss(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.