Security readout for executives and security teams
Plain-English summary
SVXportal 2.5 and earlier may let a logged-in user save script content in profile fields. When an administrator later views the user list, that script can run in the administrator’s browser, creating a risk of account misuse or data exposure through the admin session.
Executive priority
Treat as a moderate-priority remediation item. It is not currently evidenced as exploited, but administrator-session script execution can create meaningful business risk if the portal is internet-facing or accepts untrusted users.
Technical view
The reported issue is stored XSS in the profile update flow: user_settings.php submits profile fields to admin/update_user.php, and values are later rendered in admin/users.php without adequate output encoding. The CVE maps to CWE-79 with CVSS 3.1 score 6.1. Source metadata conflicts on required privileges.
Likely exposure
Exposure is likely limited to SVXportal deployments running version 2.5 or earlier where users can update profile fields and administrators review user records. The affected-version metadata is incomplete, so asset owners should verify actual deployed versions and code lineage.
Exploitation context
The bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires stored user-controlled content to be rendered in an administrator’s browser. The description says authenticated users, while the CVSS vector lists PR:N, so treat privilege requirements as unclear until validated.
Researcher notes
The strongest evidence is the described stored XSS path and VulnCheck advisory. CVSS metadata says PR:N, but the description requires authenticated profile updates. Affected version data also appears sparse, so validation should focus on deployed code behavior rather than CPE matching alone.
Mitigation direction
- Check SVXportal or project guidance for a fixed release or official mitigation.
- Inventory SVXportal instances and prioritize version 2.5 or earlier.
- Review stored profile fields for unexpected HTML or script content.
- Restrict administrative interface access to trusted networks and accounts.
- Use approved vendor or maintained-code fixes for output encoding.
Validation and detection
- Confirm whether SVXportal 2.5 or earlier is deployed.
- Review admin/users.php rendering of profile fields for output encoding.
- Check whether profile updates accept HTML or script-like content.
- Inspect admin access logs around user-list views.
- Document whether self-service or untrusted accounts exist.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27506 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/sa2blv/SVXportal/blob/master/admin/update_user.phpCVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/svxportal-admin-update-user-php-stored-xssCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.