Description
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
Remediation
References
Related Vulnerabilities
WordPress Plugin W3 Total Cache Multiple Vulnerabilities (0.9.4.1)
Envoy Proxy Uncontrolled Resource Consumption Vulnerability (CVE-2024-23323)
Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.34)
WordPress Plugin Download Plugins and Themes from Dashboard Cross-Site Scripting (1.5.0)
WordPress Plugin WP Visitor Statistics (Real Time Traffic) Cross-Site Scripting (6.4)