CVE-2025-55123: Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS att

CVE-2025-55123 · Severity: medium · CVSS 5.4 · Published 2025-11-20

Technologies: Revive-Adserver Revive Adserver. Vendors: Revive-Adserver.

Executive brief

Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.

Affected products

revive-adserver revive_adserver

Related threats

Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.
Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to a