CVE-2026-27502

SVXportal <= 2.5 log.php Search Reflected XSS

State: Published
Severity: 5.1 Medium
Published: Feb 20, 2026
Updated: Jul 14, 2026
Reserved: Feb 19, 2026

Description

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal session data, perform actions as the victim, or modify displayed content.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
SVXportalsa2blv	2.5 and earlierAffected

References

https://github.com/sa2blv/SVXportal/blob/master/log.phpproduct
https://www.vulncheck.com/advisories/svxportal-log-php-search-reflected-xssthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.