CVE-2026-27503: falha de média gravidade em sa2blv SVXportal
SVXportal <= 2.5 admin/log.php Search Reflected XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing attacker-supplied JavaScript to execute in the administrator's browser. This can enable session theft, administrative action forgery, or other browser-based compromise in the context of an admin user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
sa2blv · SVXportalCVEs relacionadas — sa2blv SVXportal
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27502MEDIUMSVXportal <= 2.5 log.php Search Reflected XSSEPSS 0.2%CVE-2026-27504MEDIUMSVXportal <= 2.5 radiomobile_front.php stationid Reflected XSSEPSS 0.2%CVE-2026-27505MEDIUMSVXportal <= 2.5 admin/user_action.php Stored XSSEPSS 0.2%CVE-2026-27506MEDIUMSVXportal <= 2.5 Profile Update Stored XSSEPSS 0.2%