PT-2026-21273 · Unknown · Svx Portal

Philopentest · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2026-27504

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.5

Description SVXportal versions prior to 2.5 are affected by a reflected cross-site scripting issue in the radiomobile front.php file. The issue occurs due to the application embedding unsanitized data from the stationid query parameter into a hidden input value field when an authenticated administrator views a specially crafted URL. This allows for attacker-supplied script injection and execution within the administrator’s browser, potentially leading to compromised admin sessions or unauthorized actions performed with the administrator’s privileges. The vulnerable parameter is stationid.

Recommendations Update SVXportal to a version later than 2.5.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27504

Produtos afetados

Svx Portal

Referências · 6

• https://github.com/sa2blv/SVXportal/blob/master/radiomobile_front.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27504 · Nota de Segurança
• https://t.me/CVEtracker/45292 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2024988792587968813 · Publicação no Twitter
• https://vulncheck.com/advisories/svxportal-radiomobile-front-php-stationid-reflected-xss · Nota
• https://osv.dev/vulnerability/CVE-2026-27504 · Aviso do Fabricante