SVXportal Reflected Cross-Site Scripting Vulnerability in log.php

A reflected cross-site scripting vulnerability has been identified in SVXportal versions through 2.5. The issue resides in log.php, where the search query parameter is not properly sanitized before being embedded into an HTML input value attribute. This flaw allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who click on a crafted URL. Exploitation of this vulnerability could lead to theft of session data, unauthorized actions performed as the victim, or manipulation of displayed content.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.