Skip to content
OpenAdvisories
Low · 3.5 CVE-2025-52667 EUVD-2025-198335GHSA-8x4v-253v-r6f5

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possi…

Published Nov 20, 2025 · Updated Dec 1, 2025 · Assigned by hackerone

Vendor: Revive Product: Revive Adserver

Description

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.

Affected products

VendorProductAffectedFixed
Revive Revive Adserver 6 – ≤ 6.0.1, 5 – ≤ 5.5.2 6.0.2

References