Back Tenable

CVE-2026-27502 | Tenable®

Tenable • February 21, 2026

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL. This can be used to steal session data, perform actions as the victim, or modify displayed content.

Published : 2026-02-20

Vector : CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Cross-Site Scripting Vulnerabilities Discovered in Web Applications Recent vulnerabilities have been identified in various web applications, including SVXportal and Dell Unisphere for PowerMax. These vulnerabilities allow unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers, potentially leading to session theft and information disclosure. The vulnerabilities were published between February 17 and February 20, 2026. 17 sources 35

Extracted Entities

CVE-2026-27502 | Tenable®

The full story

Extracted Entities

CVEs (1)

MITRE ATT&CK (1)

Vulnerabilities (1)