Read the docs
TI-2026-21906 Aliases CVE-2026-27502GHSA-pg4q-7rh5-52c9

SVXportal <= 2.5 log.php Search Reflected XSS

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal session data, perform actions as the victim, or modify displayed content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sa2blvSVXportalup to 2.5—No fix listedCNA
  • SVXportal Vendorsa2blv Affected up to 2.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:radioinorr:svxportal:*:*:*:*:*:*:*:*up to 2.5Vulnerablesa2blv
  • cpe:2.3:a:radioinorr:svxportal:*:*:*:*:*:*:*:* Versions up to 2.5 Vulnerable ·sa2blv

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27502
  2. 2026-10-03 Alias added: GHSA-pg4q-7rh5-52c9

References

Other 1

  • TI-2026-21910 SVXportal <= 2.5 Profile Update Stored XSS CVSS 4.0MEDIUM 5.1
  • TI-2026-21909 SVXportal <= 2.5 admin/user_action.php Stored XSS CVSS 4.0MEDIUM 5.1
  • TI-2026-21908 SVXportal <= 2.5 radiomobile_front.php stationid Reflected XSS CVSS 4.0MEDIUM 5.1
  • TI-2026-21907 SVXportal <= 2.5 admin/log.php Search Reflected XSS CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences