PT-2026-21275 · Unknown · Svx Portal

Philopentest · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-27506

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.5

Description SVXportal versions prior to 2.5 are affected by a stored cross-site scripting issue in the user profile update workflow. An authenticated user can inject malicious HTML or JavaScript into fields like Firstname, lastname, email, and image url. This malicious content is stored and then rendered without proper output encoding in the administrator interface, specifically in the admin/users.php page. This can lead to JavaScript execution in an administrator’s browser when viewing the affected page. The vulnerable workflow involves user settings.php submitting data to admin/update user.php.

Recommendations Update SVXportal to version 2.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27506

Affected Products

Svx Portal

References · 6

• https://osv.dev/vulnerability/CVE-2026-27506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27506 · Security Note
• https://github.com/sa2blv/SVXportal/blob/master/admin/update_user.php · Note
• https://t.me/CVEtracker/45294 · Telegram Post
• https://twitter.com/CVEnew/status/2024988783213773074 · Twitter Post
• https://vulncheck.com/advisories/svxportal-admin-update-user-php-stored-xss · Note