SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 20, 2026 · NIST NVD

   Detected

   SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal

2. Jul 14, 2026 · NIST NVD

   Updated

   SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal

Affected

• cpe radioinorr/svxportalversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27502

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27502

  SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inj

  nvd.nist.gov

References

• Product · github.com
• Third Party Advisory · vulncheck.com