PT-2026-21272 · Unknown · Svx Portal

Philopentest · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2026-27503

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.5

Description SVXportal versions 2.5 and earlier are susceptible to a reflected cross-site scripting issue within the admin/log.php component. The issue occurs due to the application embedding unsanitized data from the search query parameter directly into an HTML input value attribute. This allows an attacker to execute arbitrary JavaScript code in the browser of an authenticated administrator who views a specially crafted URL. Successful exploitation could lead to session hijacking, unauthorized administrative actions, or other browser-based compromises performed with the privileges of an administrator. The vulnerable parameter is search query.

Recommendations Versions prior to 2.5: Update to a newer version that addresses this vulnerability.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27503

Produtos afetados

Svx Portal

Referências · 6

• https://github.com/sa2blv/SVXportal/blob/master/admin/log.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27503 · Nota de Segurança
• https://vulncheck.com/advisories/svxportal-admin-log-php-search-reflected-xss · Nota
• https://twitter.com/CVEnew/status/2024988793737285831 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27503 · Aviso do Fabricante
• https://t.me/CVEtracker/45291 · Publicação no Telegram