CVE-2025-27208CWE-79cross-site-scripting

CVE-2025-27208

Medium · published October 31, 2025

CVSS v3.1
6.1
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed.

The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01469 · 73.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-31T04:15Z
Affected products (2)
ProductVersionsFixed in
revive-adserver/revive_adserver< 6.0.06.0.0
revive-adserver/revive_adserverall versions—
References (2)
https://hackerone.com/reports/3091390 · [email protected]http://seclists.org/fulldisclosure/2025/Oct/20 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 30 OCT 23:32Z
    A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2
    cvelistv5