CVE-2021-22872: Revive-Adserver Revive Adserver

Medium severity, CVSS 6.1. EPSS: 3.4% chance of exploitation in the next 30 days.

Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable.

Affected products

• Revive-Adserver Revive Adserver: before 5.1.0 (fixed in 5.1.0)

Published 2021-01-26. Last modified 2026-06-17.