SVXportal versions 2.5 and earlier contain a reflected cross‑site scripting flaw in the radiomobile_front.php page. The stationid query parameter is inserted into a hidden input field without sanitization, allowing an attacker to inject script that runs in the browser of any authenticated administrator who visits a crafted link. This can lead to session hijacking or the execution of arbitrary actions in the administrator’s authenticated context, compromising the integrity and confidentiality of system management functions.

The affected product is SVXportal, a radio management application sold by sa2blv. Versions 2.5 and earlier are vulnerable; there is no indication that later releases address the flaw. The vulnerability is accessed via radiomobile_front.php when the stationid parameter is present.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The flaw is not currently listed in CISA’s KEV catalog. Exploitation requires an attacker to lure or trick an authenticated administrator into visiting a malicious URL, after which the embedded script executes with the administrator’s privileges. While the attack vector is limited to users with administrative access, the impact on compromised admin sessions can be severe.