PT-2026-21274 · Unknown · Svx Portal

Philopentest · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-27505

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.5

Description The software contains a stored cross-site scripting issue in the user registration process. The index.php page submits data to the admin/user action.php endpoint. User-provided data, including the Firstname, lastname, and email fields, is saved to the backend database without proper output encoding. This data is then displayed in the administrator interface via the admin/users.php page, enabling an unauthenticated remote attacker to inject and execute arbitrary JavaScript code within an administrator’s browser.

Recommendations Update to a version later than 2.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27505

Affected Products

Svx Portal

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-27505 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27505 · Vendor Advisory
• https://github.com/sa2blv/SVXportal/blob/master/admin/user_action.php · Note
• https://twitter.com/CVEnew/status/2024988791350722697 · Twitter Post
• https://vulncheck.com/advisories/svxportal-admin-user-action-php-stored-xss · Note
• https://t.me/CVEtracker/45293 · Telegram Post