A stored cross‑site scripting flaw exists in SVXportal 2.5 and earlier. Fields such as Firstname, Lastname, Email, and Image_url accept user input that is later rendered without proper output encoding within the administrator views. If an attacker injects malicious JavaScript, it will execute when an administrator opens the affected page, potentially granting control over the admin's browser session.

The vulnerability affects the SVXportal application provided by sa2blv. All releases up to and including version 2.5 are susceptible. No specific sub‑versions are highlighted beyond the version ceiling of 2.5.

The CVSS score of 5.1 indicates moderate severity. EPSS is listed as less than 1%, implying a very low probability of exploitation, and the vulnerability is not part of the CISA KEV catalog. The attack vector requires the attacker to be an authenticated user, meaning prior compromise or social engineering to gain user credentials is necessary. Once authenticated, the attacker can store payloads in the indicated fields; these payloads will then be executed in any administrator's browser that views the edited user profile. The impact is confined to the browser environment of the admin and does not provide system‑wide code execution or other privilege escalation beyond the browser context.