A missing sanitization in the zone-include.php script of Revive Adserver allows a low‑privileged user to supply malicious content through the refresh parameter of an iFrame invocation tag. The input is reflected back without proper encoding, enabling attackers to inject and execute arbitrary JavaScript in the context of the victim’s browser, potentially leading to session hijacking, data theft, or phishing campaigns.

This vulnerability exists in Revive Adserver 6.0.7 and all earlier releases. The affected product is the Revive Adserver platform provided by Revive.

The CVSS score of 6.1 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the iFrame invocation’s refresh parameter within the web interface, allowing a low‑privileged user to inject malicious payloads. The reflected nature of the XSS makes it straightforward to target user browsers and potentially execute session hijacking or phishing attacks.