SVXportal versions 2.5 and earlier store user input such as Firstname, Lastname, and Email without proper output encoding. A malicious user can register with specially crafted data that includes JavaScript; when an administrator later views the user list, the stored script runs in the admin’s browser. This stored cross‑site scripting enables an attacker to execute arbitrary code in the context of an authenticated administrator.

The vulnerability affects the SVXportal application distributed by SA2BLV, specifically all public releases up to and including version 2.5. Admin interfaces rendered by admin/users.php are impacted.

The CVSS score of 5.1 indicates a medium impact area, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can inject code by submitting a registration form with malicious input, then wait for an administrator to load the affected admin page. The attacker does not need credentials to insert the payload, but must rely on an authenticated admin to render the stored script. Overall risk remains moderate due to the need for an admin to trigger execution, combined with the low exploit probability.