A reflected XSS flaw exists in the afr.php delivery script used by Revive Adserver. When an attacker crafts a URL containing malicious HTML content in a parameter, a logged‑in administrator who visits that URL will have the payload rendered by their browser, enabling the execution of arbitrary scripts in the context of the administrator account. Because the attack requires the target to be authenticated, successful exploitation can lead to session hijacking, credential theft, or further lateral movement within the system.

Revive Adserver supplied by Revive. No specific affected versions are listed in the CVE data, so all deployed installations of Revive Adserver may be at risk until a vendor patch is released.

The flaw carries a moderate severity CVSS score of 6.1. The EPSS score is reported at less than 1%, indicating low but non‑zero likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. The attacker must be a logged‑in administrator, and the threat vector is inferred to be a web‑based attack via a crafted URL. Given the moderate score and low exploitation probability, the risk is moderate but the potential impact on confidentiality and integrity is significant if an administrator is compromised.