CVE-2025-27208

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed. The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://hackerone.com/reports/3091390	Exploit Issue Tracking Patch Third Party Advisory
http://seclists.org/fulldisclosure/2025/Oct/20	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:revive-adserver:revive_adserver::::::::
	cpe:2.3:a:revive-adserver:revive_adserver:6.0.0:rc1::::::

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una vulnerabilidad de cross-site scripting (XSS) reflejado en Revive Adserver versión 5.5.2. Un atacante podría engañar a un usuario con acceso a la interfaz de usuario de una instancia de Revive Adserver para que haga clic en una URL específicamente diseñada y ejecutar código JavaScript inyectado en el contexto del navegador de la víctima. La cookie de sesión no puede ser accedida, pero se podrían realizar otras operaciones. La vulnerabilidad está presente en el archivo admin-search.php y puede ser explotada a través del parámetro compact.

Information

Published : 2025-10-31 00:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-27208

Mitre link : CVE-2025-27208

CVE.ORG link : CVE-2025-27208

JSON object : View

Products Affected

revive-adserver

revive_adserver

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-27208", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27208", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T14:48:53.803332Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Revive", "product": "Revive Adserver", "versions": [{"status": "affected", "version": "5.5.2", "versionType": "semver", "lessThanOrEqual": "5.5.2"}, {"status": "unaffected", "version": "6.0.0", "lessThan": "6.0.0", "versionType": "semver"}]}]}], "published": "2025-10-31T00:15:36.190", "references": [{"url": "https://hackerone.com/reports/3091390", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "http://seclists.org/fulldisclosure/2025/Oct/20", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed.\r\n\r\nThe vulnerability is present in the admin-search.php file and can be exploited via the compact parameter."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de cross-site scripting (XSS) reflejado en Revive Adserver versi\u00f3n 5.5.2. Un atacante podr\u00eda enga\u00f1ar a un usuario con acceso a la interfaz de usuario de una instancia de Revive Adserver para que haga clic en una URL espec\u00edficamente dise\u00f1ada y ejecutar c\u00f3digo JavaScript inyectado en el contexto del navegador de la v\u00edctima. La cookie de sesi\u00f3n no puede ser accedida, pero se podr\u00edan realizar otras operaciones.\n\nLa vulnerabilidad est\u00e1 presente en el archivo admin-search.php y puede ser explotada a trav\u00e9s del par\u00e1metro compact."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB72680D-5CE9-4943-9524-B706CF10EFB2", "versionEndExcluding": "6.0.0"}, {"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:6.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3532AF55-1C9C-4B04-A68C-A2634F505C39"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}