Revive Adserver CVE-2025-27208

Exploitation requires that the victim be a user with access to the Revive Adserver administrative interface who is tricked into clicking a specifically crafted URL hitting admin-search.php with a malicious value in the compact parameter (reflected XSS, CWE-79). Key limiting factors: mandatory user interaction (UI:R) - the attack cannot fire without the victim clicking the link - and the target must have UI access, so purely external, non-interacting users cannot be exploited. Per the vendor, the session cookie cannot be accessed (likely HttpOnly), which limits impact to in-browser actions within the victim's authenticated context rather than full session theft. Affected version is 5.5.2 (a 6.0.0-rc1 CPE is also listed); a vendor patch is available.

This is a moderate-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) that should be treated as a patch-in-normal-cycle issue rather than an emergency. Signals are internally consistent and point to limited real-world danger: the attack vector is network (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but it is gated by required user interaction (UI:R) - the victim must be an authenticated operator who clicks a crafted link - and impact is only Low/Low/None, reflecting that the vendor states the session cookie cannot be stolen. EPSS is 1.47% (73rd percentile), which is elevated for a run-of-the-mill XSS and consistent with the fact that public exploit code exists (HackerOne report #3091390), but it is far from the high-probability tier. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation; POC availability and active exploitation are distinct and must not be conflated here. Net: a real but bounded issue - meaningful because a working PoC is public and scope is changed (S:C), yet constrained by the requirement for a privileged, interacting victim and the inability to hijack the session cookie.

An attacker crafts a malicious URL targeting admin-search.php with a payload in the compact parameter and lures an authenticated Revive Adserver operator (e.g., via phishing or a planted link) into clicking it. When the victim's browser loads the page, the reflected, unsanitized input executes attacker-controlled JavaScript in the admin UI context, allowing actions on the victim's behalf. A public proof-of-concept exists in HackerOne report #3091390, lowering the barrier to reliable exploitation.