CVE-2025-63724
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
SVX Portal 2.7A has a SQL injection (SQL-i) vulnerability via a crafted POST request to admin/update_setings.php.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data disclosure, modification or deletion, and application takeover.
Recommendation
Use parameterized queries and input validation in admin/update_setings.php and restrict access to the administrative panel.
Other vulnerabilities in SVX Portal
See all- CVE-2025-63725Medium
A reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php.
- CVE-2025-61532Medium
A Cross Site Scripting (XSS) vulnerability in SVX Portal v.2.7A allows execution of arbitrary code via the TG parameter on the last_heard_page.php component.
Original NVD description (English source)
SQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS