Medium severity6.1NVD Advisory· Published Oct 31, 2025· Updated Oct 7, 2026
CVE-2025-27208
CVE-2025-27208
Description
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed.
The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4=5.5.2+ 3 more
- (no CPE)range: =5.5.2
- (no CPE)range: 5.5.2
- cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*range: <6.0.0
- cpe:2.3:a:revive-adserver:revive_adserver:6.0.0:rc1:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
2- seclists.org/fulldisclosure/2025/Oct/20nvdMailing ListPatchThird Party Advisory
- hackerone.com/reports/3091390nvdExploitIssue TrackingPatchThird Party Advisory
News mentions
0No linked articles in our index yet.