PT-2026-21273 · Unknown · Svx Portal

Philopentest · CVE-2026-27504 · Published 2026-02-20 · Updated 2026-02-20

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SVXportal versions prior to 2.5

Description SVXportal versions prior to 2.5 are affected by a reflected cross-site scripting issue in the radiomobile front.php file. The issue occurs due to the application embedding unsanitized data from the stationid query parameter into a hidden input value field when an authenticated administrator views a specially crafted URL. This allows for attacker-supplied script injection and execution within the administrator’s browser, potentially leading to compromised admin sessions or unauthorized actions performed with the administrator’s privileges. The vulnerable parameter is stationid.

Recommendations Update SVXportal to a version later than 2.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27504

Affected Products

Svx Portal

References · 6

• https://osv.dev/vulnerability/CVE-2026-27504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27504 · Security Note
• https://github.com/sa2blv/SVXportal/blob/master/radiomobile_front.php · Note
• https://t.me/CVEtracker/45292 · Telegram Post
• https://vulncheck.com/advisories/svxportal-radiomobile-front-php-stationid-reflected-xss · Note
• https://twitter.com/CVEnew/status/2024988792587968813 · Twitter Post