The banner‑acl.php file of Revive Adserver contains a reflected cross‑site scripting vulnerability. By inserting a crafted URL that embeds HTML or JavaScript into a parameter, an attacker can cause the payload to be rendered when a logged‑in administrator opens the link. The resulting execution of malicious script compromises the administrator’s session and can lead to credential theft, content defacement, or further lateral movement within the advertiser network.

Any installation of Revive Adserver that has not been updated to include the vendor’s fix for the banner‑acl.php script is affected. The advisory does not specify a version range, so all unpatched deployments are potentially vulnerable.

The CVSS score of 6.1 indicates a moderate risk, while the EPSS score of less than 1% suggests a low immediate likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying there are no publicly documented exploits. Successful exploitation requires an authenticated administrator to click the crafted link, so an attacker would likely rely on social engineering or a compromised email to deliver the malicious URL. Despite the low exploitation probability, the impact on privileged accounts makes this a high priority to remediate.