Executive brief
SVXportal, a web portal for managing radio nodes, contains a security flaw in its user profile update system. An attacker with a standard user account can save malicious code into their profile fields, such as their name or email address. If a system administrator later views the list of users, this code will run in their browser, potentially allowing the attacker to hijack the administrator's session or perform unauthorized actions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SVXportal version 2.5 and prior within the user_settings.php component. The application fails to adequately sanitize or encode user-supplied input in fields such as 'Firstname', 'lastname', 'email', and 'image_url' before storing them via admin/update_user.php. When an administrator views the user management interface (admin/users.php), the stored malicious JavaScript is rendered and executed in the context of the administrator's session. This allows for potential session hijacking or unauthorized administrative actions. The vulnerability requires basic user authentication to exploit.
Affected products
- sa2blv SVXportal 2.5 and prior
Timeline
- 2026-02-20: disclosed: Initial disclosure by VulnCheck
- 2026-02-20: advisory: NVD published the CVE entry