PT-2026-21271 · Unknown · Svx Portal

Philopentest · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-27502

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.6

Description The application has a reflected cross-site scripting issue in the 'log.php' file through the search query parameter. The application directly includes the unsanitized parameter value into an HTML input value attribute. This allows a remote attacker to inject and execute arbitrary JavaScript in a victim’s browser by sending a crafted URL. Successful exploitation could lead to session data theft, unauthorized actions performed as the victim, or modification of displayed content.

Recommendations Versions prior to 2.6 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27502

Affected Products

Svx Portal

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-27502 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27502 · Vendor Advisory
• https://github.com/sa2blv/SVXportal/blob/master/log.php · Note
• https://twitter.com/CVEnew/status/2024988796136423471 · Twitter Post
• https://vulncheck.com/advisories/svxportal-log-php-search-reflected-xss · Note
• https://t.me/CVEtracker/45290 · Telegram Post