Skip to content

Vendor

sa2blv vulnerabilities

5 published CVES affecting sa2blv, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
5
Critical
0
High
0
Medium
5
Low
0
Unscored
0
CISA KEV
0
Atom feed of sa2blv alerts

Products

Latest sa2blv CVEs

Newest publication first

  1. CVE-2026-27506 SVXportal <= 2.5 Profile Update Stored XSS

    Published
    MediumCVSS 5.1 EPSS 0.20%

    SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow (user_settings.php submitting to admin/update_user.php). Authenticated users can store malicious HTML/JavaScript in fields such as Firstname, lastname, email, a...

  2. CVE-2026-27505 SVXportal <= 2.5 admin/user_action.php Stored XSS

    Published
    MediumCVSS 5.1 EPSS 0.22%

    SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user registration workflow (index.php submitting to admin/user_action.php). User-supplied fields such as Firstname, lastname, and email are stored in the backend database without adequate o...

  3. CVE-2026-27504 SVXportal <= 2.5 radiomobile_front.php stationid Reflected XSS

    Published
    MediumCVSS 5.1 EPSS 0.22%

    SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in radiomobile_front.php via the stationid query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value into a hidden input v...

  4. CVE-2026-27503 SVXportal <= 2.5 admin/log.php Search Reflected XSS

    Published
    MediumCVSS 5.1 EPSS 0.19%

    SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input valu...

  5. CVE-2026-27502 SVXportal <= 2.5 log.php Search Reflected XSS

    Published
    MediumCVSS 5.1 EPSS 0.24%

    SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inj...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.