PT-2026-21271 · Unknown · Svx Portal

Philopentest · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2026-27502

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.6

Description The application has a reflected cross-site scripting issue in the 'log.php' file through the search query parameter. The application directly includes the unsanitized parameter value into an HTML input value attribute. This allows a remote attacker to inject and execute arbitrary JavaScript in a victim’s browser by sending a crafted URL. Successful exploitation could lead to session data theft, unauthorized actions performed as the victim, or modification of displayed content.

Recommendations Versions prior to 2.6 should be updated.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27502

Produtos afetados

Svx Portal

Referências · 6

• https://github.com/sa2blv/SVXportal/blob/master/log.php · Nota
• https://twitter.com/CVEnew/status/2024988796136423471 · Publicação no Twitter
• https://vulncheck.com/advisories/svxportal-log-php-search-reflected-xss · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27502 · Nota de Segurança
• https://t.me/CVEtracker/45290 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27502 · Aviso do Fabricante