CVE-2026-27502 is a reflected cross-site scripting vulnerability in SVXportal version 2.5 and prior. The issue arises because the application embeds the unsanitized 'search' query parameter directly into an HTML input value attribute in log.php. This improper neutralization of input (CWE-79) enables an unauthenticated attacker to craft a URL that executes arbitrary JavaScript in the context of a victim's browser. The vulnerability can lead to session hijacking, unauthorized actions, or content manipulation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope and impact on confidentiality and integrity.

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the victim's browser when the victim visits a maliciously crafted URL. This can result in theft of session cookies, unauthorized actions performed as the victim, or modification of the displayed web content. The vulnerability does not require authentication and has a medium severity score of 5.1. There are no known exploits in the wild currently.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. As a temporary mitigation, avoid clicking on untrusted links that include the vulnerable parameter or consider implementing web application firewall (WAF) rules to detect and block suspicious input in the 'search' parameter. Review and apply proper input sanitization and output encoding in the affected code if possible.