# CVE-2026-27504: sa2blv SVXportal reflected XSS in radiomobile_front.php

Source: https://junglewise.ai/threats/cve-2026-27504-sa2blv-svxportal-reflected-xss-in-radiomobile-front-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-20. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-27504 · Severity: medium · CVSS 6.1 · Published 2026-02-20

SVXportal, a web portal for managing radio station nodes, contains a security flaw that allows attackers to execute malicious scripts in an administrator's browser. By tricking a logged-in administrator into clicking a specially crafted link, an attacker could hijack their session or perform unauthorized administrative actions. This could lead to a full compromise of the portal's management interface and its connected radio infrastructure.

Technologies: [Radioinorr Svxportal](https://junglewise.ai/threats/technologies/svxportal). Vendors: [Radioinorr](https://junglewise.ai/threats/vendors/radioinorr).

## Quick answers

**Is CVE-2026-27504 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27504 being exploited in the wild.

**How severe is CVE-2026-27504?** Medium severity, with a CVSS score of 6.1, published 20 February 2026.

**Which products and versions are affected?** sa2blv SVXportal <= 2.5.

**Is there a fix for CVE-2026-27504?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-27504 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-27504?** Check whether you run Radioinorr Svxportal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in SVXportal version 2.5 and earlier within the 'radiomobile_front.php' component. The root cause is the improper neutralization of the 'stationid' query parameter before it is embedded into a hidden input field's value attribute. An unauthenticated remote attacker can exploit this by inducing an authenticated administrator to visit a crafted URL. Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser session, potentially leading to session token theft or unauthorized administrative configuration changes. As of the advisory date, no official patch has been confirmed, though users are advised to sanitize input or restrict access to the administrative interface.

## Affected products

- sa2blv SVXportal <= 2.5

## Timeline

- 2026-02-20: disclosed
- 2026-02-20: advisory

## References

- [https://github.com/sa2blv/SVXportal/blob/master/radiomobile_front.php](https://github.com/sa2blv/SVXportal/blob/master/radiomobile_front.php)
- [https://www.vulncheck.com/advisories/svxportal-radiomobile-front-php-stationid-reflected-xss](https://www.vulncheck.com/advisories/svxportal-radiomobile-front-php-stationid-reflected-xss)

## Related threats

- [sa2blv SVXportal stored XSS in user profile update](https://junglewise.ai/threats/cve-2026-27506-sa2blv-svxportal-stored-xss-in-user-profile-update)
- [sa2blv SVXportal stored XSS in user registration workflow](https://junglewise.ai/threats/cve-2026-27505-sa2blv-svxportal-stored-xss-in-user-registration-workflow)
- [sa2blv SVXportal reflected XSS in admin/log.php](https://junglewise.ai/threats/cve-2026-27503-sa2blv-svxportal-reflected-xss-in-admin-log-php)
- [sa2blv SVXportal reflected XSS in log.php](https://junglewise.ai/threats/cve-2026-27502-sa2blv-svxportal-reflected-xss-in-log-php)