Stored XSS Vulnerability in Revive Adserver by Revive Adserver
CVE-2025-52667

3.5LOW

Key Information:

Vendor

Revive

Status
Revive Adserver
Vendor
CVE Published:
20 November 2025

What is CVE-2025-52667?

A security flaw in Revive Adserver allows logged-in manager users to be targeted by stored cross-site scripting attacks due to the absence of a JSON Content-Type header in specific scripts. This vulnerability facilitates malicious scripts to be executed in the context of the affected user, potentially leading to unauthorized data exposure or loss.

Affected Version(s)

Revive Adserver 6 <= 6.0.1

Revive Adserver 5 <= 5.5.2

Revive Adserver 6.0.2

References

https://hackerone.com/reports/3399809

CVSS V3.0

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-52667 : Stored XSS Vulnerability in Revive Adserver by Revive Adserver