CVE-2026-27504 is a reflected XSS vulnerability in SVXportal (version 2.5 and prior) affecting the radiomobile_front.php page. The issue arises because the stationid query parameter is embedded unsanitized into a hidden input field when viewed by an authenticated administrator. This improper neutralization of input (CWE-79) allows attacker-supplied scripts to execute in the administrator's browser context, potentially compromising admin sessions or enabling unauthorized administrative actions. The vulnerability requires user interaction (administrator visiting a crafted URL) and has no reported exploits or patches at this time.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of an authenticated administrator. This can lead to session hijacking or unauthorized actions performed with administrator privileges. The vulnerability is limited to administrators who interact with maliciously crafted URLs. There are no known exploits in the wild, and the vulnerability does not affect unauthenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted or suspicious URLs containing the stationid parameter. Implementing web application firewall (WAF) rules to detect and block malicious input patterns may help mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.