https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27506.htmlhttps://patchthecve.com/cve/CVE-2026-27506.htmlTue, 14 Jul 2026 19:16:52 +0000MEDIUM 6.1: SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow (user_settings.php submitting to admin/update_user.php). Authenticated users can store malicious HTML/JavaScript in fields such as Firstname, lastname, email, and image_url, which https://patchthecve.com/cve/CVE-2026-27505.htmlhttps://patchthecve.com/cve/CVE-2026-27505.htmlTue, 14 Jul 2026 19:16:52 +0000MEDIUM 6.1: SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user registration workflow (index.php submitting to admin/user_action.php). User-supplied fields such as Firstname, lastname, and email are stored in the backend database without adequate output encoding and ahttps://patchthecve.com/cve/CVE-2026-27504.htmlhttps://patchthecve.com/cve/CVE-2026-27504.htmlTue, 14 Jul 2026 19:16:52 +0000MEDIUM 6.1: SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in radiomobile_front.php via the stationid query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value into a hidden input value field, allowinghttps://patchthecve.com/cve/CVE-2026-27503.htmlhttps://patchthecve.com/cve/CVE-2026-27503.htmlTue, 14 Jul 2026 19:16:52 +0000MEDIUM 6.1: SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowinhttps://patchthecve.com/cve/CVE-2026-27502.htmlhttps://patchthecve.com/cve/CVE-2026-27502.htmlTue, 14 Jul 2026 19:16:52 +0000MEDIUM 6.1: SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbi