Description
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code.
Remediation
References
Related Vulnerabilities
Oracle HTTP Server Out-of-bounds Write Vulnerability (CVE-2021-4034)
WordPress Plugin WP Gravity Forms Zendesk Cross-Site Scripting (1.0.7)
WordPress Plugin Restaurant Menu-Food Ordering System-Table Reservation Security Bypass (2.3.0)
Ruby CVE-2019-15845 Vulnerability (CVE-2019-15845)
Squid Missing Release of Resource after Effective Lifetime Vulnerability (CVE-2018-19132)