The flaw arises when Revive AdServer 6.0.7 outputs entity names without escaping, allowing attackers to embed malicious scripts into the maintenance‑acl‑check.php and maintenance‑banners‑check.php pages. The stored payload may be executed in an administrator’s browser when the tools are loaded, although execution is not guaranteed in all circumstances, and the vulnerability is classified as CWE‑79.

Affected installations are those running Revive AdServer 6.0.7 and using the maintenance‑acl‑check.php and maintenance‑banners‑check.php components. Administrators who invoke these tools are the primary victims.

With a CVSS score of 5.4 the issue is deemed medium severity; the EPSS score of less than 1 percent indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalogue. The attack requires an attacker to insert the malicious entity name into the system and for an authorized administrator to later access one of the vulnerable maintenance pages, so the vector is limited to compromised or privileged accounts.