SVXportal versions 2.5 and prior are affected by a reflected XSS vulnerability (CWE-79) in the admin/log.php script. The issue arises because the search query parameter is embedded directly into an HTML input value attribute without proper sanitization or neutralization. When an authenticated administrator accesses a maliciously crafted URL, attacker-controlled JavaScript executes in their browser context. This can facilitate session hijacking, forgery of administrative actions, or other browser-based attacks targeting the admin user. No known exploits are reported in the wild, and no vendor patch or advisory is currently available.

Successful exploitation allows execution of arbitrary JavaScript in the browser of an authenticated administrator. This can lead to theft of session tokens, unauthorized administrative commands, or other compromises within the admin's browser session. The impact is limited to users with administrative privileges who interact with the vulnerable page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted or suspicious URLs containing crafted parameters targeting the admin/log.php page. Implementing web application firewall (WAF) rules to detect and block malicious input patterns may provide temporary mitigation.