CVE-2025-61532

MediumCVSS 6.1

Published: 09/10/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in SVX Portal v.2.7A allows execution of arbitrary code via the TG parameter on the last_heard_page.php component.

Risk Assessment

An attacker can execute arbitrary JavaScript in a portal user's browser, potentially leading to session or credential theft.

Recommendation

Apply the vendor patch or properly validate and encode input for the TG parameter in last_heard_page.php.

Other vulnerabilities in SVX Portal

See all

CVE-2025-63725Medium
A reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php.
CVE-2025-63724Medium
SVX Portal 2.7A has a SQL injection (SQL-i) vulnerability via a crafted POST request to admin/update_setings.php.

Original NVD description (English source)

Cross Site Scripting vulnerability in SVX Portal v.2.7A to execute arbitrary code via the TG parameter on last_heard_page.php component

Vulnerability data from NVD (NIST) · CISA KEV · EPSS