Vulnerability · Published Feb 20, 2026 · Assigned by VulnCheck

CVE-2026-27502SVXportal <= 2.5 log.php Search Reflected XSS

Medium 6.1

In plain English

A medium-severity cross-site scripting in SVXportal from sa2blv. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 84.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal session data, perform actions as the victim, or modify displayed content.

Affected products (as reported)

Vendor	Product	Versions
sa2blv	SVXportal	0 – through 2.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/sa2blv/SVXportal/blob/master/log.php product
https://www.vulncheck.com/advisories/svxportal-log-php-search-reflected-xss third-party-advisory