CVE-2026-27506: falha de média gravidade em sa2blv SVXportal
SVXportal <= 2.5 Profile Update Stored XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow (user_settings.php submitting to admin/update_user.php). Authenticated users can store malicious HTML/JavaScript in fields such as Firstname, lastname, email, and image_url, which are later rendered without adequate output encoding in the administrator interface (admin/users.php), resulting in JavaScript execution in an administrator's browser when the affected page is viewed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
sa2blv · SVXportalCVEs relacionadas — sa2blv SVXportal
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27502MEDIUMSVXportal <= 2.5 log.php Search Reflected XSSEPSS 0.2%CVE-2026-27504MEDIUMSVXportal <= 2.5 radiomobile_front.php stationid Reflected XSSEPSS 0.2%CVE-2026-27505MEDIUMSVXportal <= 2.5 admin/user_action.php Stored XSSEPSS 0.2%CVE-2026-27503MEDIUMSVXportal <= 2.5 admin/log.php Search Reflected XSSEPSS 0.2%