The vulnerability is a reflected XSS flaw discovered in the banner-acl.php and channel-acl.php scripts of Revive Adserver. An attacker can embed hostile HTML or JavaScript in a parameter of a specially crafted URL. When a logged‑in administrator opens that URL, the server echoes the payload back to the browser and the malicious script runs with the administrator’s privileges.

Revive:Revive Adserver. No specific version information is available, so any deployed instance that includes the banner-acl.php and channel-acl.php modules is potentially affected until a fix is applied.

The CVSS score of 6.1 indicates a medium severity level, while the EPSS score of less than 1% points to a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivering the crafted URL to a legitimate administrator and convincing them to visit it; the attack would run only in the context of the administrator’s session.