CVE-2026-27503

Katalog CVE

CVSS 6.1 · Medium EPSS 0,28%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada radioinorr svxportal. Skor CVSS 3.1 6.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing attacker-supplied JavaScript to execute in the administrator's browser. This can enable session theft, administrative action forgery, or other browser-based compromise in the context of an admin user.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/svxportal-admin-log-php-search-reflected-xss advisory pihak ketiga
• https://github.com/sa2blv/SVXportal/blob/master/admin/log.php product