A stored cross‑site scripting flaw allows an attacker to embed malicious JavaScript into usernames. When an administrator opens the audit log entry that displays the username, the application renders the value without proper escaping, causing the injected script to run in the admin’s browser. This flaw provides client‑side code execution only within the context of those privileged sessions that view the affected audit log details.

The vulnerability impacts the Revive Adserver platform. No specific product versions are mentioned, so any deployed instance of Revive Adserver that uses the audit log and accepts user‑provided usernames could be affected.

The flaw requires an attacker to insert malicious content into a username and for an administrator to view that log entry. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, so quantitative risk assessment is not possible. The risk is limited to scenarios where a malicious username can be created and where an admin subsequently accesses the audit log. The vendor has issued a fix that implements proper escaping for audit log output.