CVE-2026-27504 is a reflected XSS vulnerability in SVXportal (sa2blv) affecting version 2.5 and prior. The issue arises because the application embeds the unsanitized stationid query parameter into a hidden input field in radiomobile_front.php. When an authenticated administrator accesses a maliciously crafted URL, attacker-supplied scripts execute in their browser context, potentially compromising the administrator's session or enabling unauthorized administrative actions.

Successful exploitation enables an attacker to execute arbitrary scripts in the context of an authenticated administrator's browser session. This can lead to session hijacking or unauthorized administrative actions within SVXportal, potentially compromising the integrity and security of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted or suspicious URLs containing the stationid parameter. Implementing input validation and output encoding on the stationid parameter can mitigate the risk. Monitor vendor channels for official patches or updates.