A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed.
The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/3091390 | Exploit Patch Third Party Advisory Issue Tracking |
| http://seclists.org/fulldisclosure/2025/Oct/20 | Mailing List Third Party Advisory Patch |
Configurations
Configuration 1 (hide)
|
History
12 Nov 2025, 16:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hackerone.com/reports/3091390 - Exploit, Patch, Third Party Advisory, Issue Tracking | |
| References | () http://seclists.org/fulldisclosure/2025/Oct/20 - Mailing List, Third Party Advisory, Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Revive-adserver
Revive-adserver revive Adserver |
|
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:revive-adserver:revive_adserver:6.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:* |
03 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Oct 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-31 00:15
Updated : 2025-11-12 16:41
NVD link : CVE-2025-27208
Mitre link : CVE-2025-27208
CVE.ORG link : CVE-2025-27208
JSON object : View
Products Affected
revive-adserver
- revive_adserver
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')