Executive brief
SVXportal, a web portal for managing radio nodes, contains a security flaw in its administrative logging page. If an administrator clicks on a specially crafted link, an attacker can execute malicious code within their browser. This could allow the attacker to steal the administrator's session, perform unauthorized actions, or compromise the management interface.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SVXportal versions 2.5 and earlier within the 'admin/log.php' component. The vulnerability is triggered via the 'search' query parameter, which is improperly neutralized before being rendered into an HTML input value attribute. An attacker can exploit this by tricking an authenticated administrator into visiting a malicious URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking or administrative action forgery. The issue is tracked as CWE-79.
Affected products
- sa2blv SVXportal <= 2.5
Timeline
- 2026-02-20: advisory: Initial advisory published by VulnCheck
- 2026-02-20: disclosed: CVE-2026-27503 assigned