SVXportal versions 2.5 and earlier allow a reflected cross‑site scripting flaw in the admin/log.php endpoint. An authenticated administrator who opens a maliciously crafted URL containing an unsanitized search parameter can inject JavaScript that executes in the attacker’s context. This can lead to session theft, forgery of administrative actions, and broader browser‑based compromise. The weakness is classified as CWE‑79.

The affected product is SVXportal, supplied by the vendor sa2blv, and includes all releases up to and including version 2.5. No patch has been issued at the time of this assessment, and users are advised to verify whether newer releases incorporate a fix.

The CVSS score of 5.1 indicates moderate severity, while the EPSS rating of less than 1 % reflects a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Compromise requires an authenticated administrator with web UI access; an attacker must craft a URL, lure an admin to click, and provide the malicious payload. Although the exploitation path is straightforward, the realistic risk remains modest under current conditions.