Revive Adserver EUVD-2026-39605

Exploitation requires the victim to interact with a specially crafted URL pointing to the stats-video.php script (UI:R per CVSS vector). The attacker does not need any authentication credentials (PR:N). The description notes that URL construction for this script did not follow best practices, implying specific URL parameter patterns are needed - the exact parameter name is not disclosed in available data. Exploitation is limited by: (1) victim must actively follow or be redirected to the crafted URL; (2) the vulnerable script must be publicly accessible (i.e., the adserver's stats-video.php endpoint is reachable from the attacker's network); (3) AC:H in the original CVSS vector suggests some URL crafting complexity, possibly related to how the script expects URL structure. There is no indication of a non-default configuration requirement - the vulnerability appears present in the standard deployment of the stats-video.php endpoint.

The NVD-assigned CVSS 3.0 score is 4.7 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. The Scope:Changed designation reflects that exploitation crosses from the web application into the victim's browser security context, which is correct for reflected XSS. The AC:H rating in the original vector likely captures the specific URL construction constraints described, though this analyst assesses AC:L as more representative once the vulnerable parameter is identified (see assessed vector). No EPSS data was provided in the input; no KEV listing exists; no confirmed public exploit code has been identified. Taken together, the real-world risk is moderate: while reflected XSS typically requires social engineering to deliver the crafted link (UI:R), the lack of any authentication requirement (PR:N) means any internet user could be targeted. The primary limiting factor is victim interaction, not attacker capability. This is a genuine security issue but not an emergency patch priority absent active exploitation evidence.

An attacker identifies the vulnerable parameter in the stats-video.php URL and crafts a link embedding a JavaScript payload (e.g., a cookie-stealing script) that passes through the Smarty url helper without encoding. The attacker then delivers this URL to a victim - typically via email, chat, or a compromised third-party page - and when the victim's browser requests the URL, the adserver reflects the payload back in the response, executing it in the victim's browser session under the adserver's origin. No public exploit code has been identified at time of analysis, but reflected XSS of this type is straightforward to exploit manually.