PT-2026-21274 · Unknown · Svx Portal

Philopentest · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2026-27505

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.5

Description The software contains a stored cross-site scripting issue in the user registration process. The index.php page submits data to the admin/user action.php endpoint. User-provided data, including the Firstname, lastname, and email fields, is saved to the backend database without proper output encoding. This data is then displayed in the administrator interface via the admin/users.php page, enabling an unauthenticated remote attacker to inject and execute arbitrary JavaScript code within an administrator’s browser.

Recommendations Update to a version later than 2.5.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27505

Produtos afetados

Svx Portal

Referências · 6

• https://github.com/sa2blv/SVXportal/blob/master/admin/user_action.php · Nota
• https://twitter.com/CVEnew/status/2024988791350722697 · Publicação no Twitter
• https://vulncheck.com/advisories/svxportal-admin-user-action-php-stored-xss · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27505 · Nota de Segurança
• https://t.me/CVEtracker/45293 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27505 · Aviso do Fabricante