CVE-2026-27502 is a reflected XSS vulnerability in SVXportal (sa2blv) affecting version 2.5 and prior. The issue arises because the application directly embeds the unsanitized 'search' query parameter into an HTML input value attribute in log.php. This improper neutralization of input (CWE-79) enables an unauthenticated attacker to craft a URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser context. This can be leveraged to steal session data, perform actions on behalf of the victim, or alter displayed content. No patch or official fix details are currently available.

An attacker can execute arbitrary JavaScript in the context of a victim's browser by exploiting the reflected XSS vulnerability. This can lead to session hijacking, unauthorized actions performed as the victim, and manipulation of web page content. The vulnerability requires the victim to visit a specially crafted URL. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted links that may exploit this vulnerability. Application developers should implement proper input sanitization and output encoding for the 'search' parameter in log.php to prevent script injection.