The flaw arises when the search query parameter in log.php is written directly into an HTML input value without any sanitization. An attacker can construct a URL containing malicious JavaScript; when a victim opens that link the script executes in the victim’s browser. This lets the attacker steal session cookies, perform actions on behalf of the user, or alter displayed content. The weakness is a classic reflected XSS problem identified as CWE‑79.

SVXportal 2.5 and all earlier releases from sa2blv are impacted. Versions newer than 2.5 are presumed to have the issue resolved.

The CVSS score of 5.1 labels the vulnerability as moderate, yet the EPSS score is below 1% and it is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation at this time. An attacker can exploit it remotely and without authentication by luring a user to a crafted URL. The main risk is the potential for session hijacking or unauthorized actions performed in the victim’s name.