CVE-2016-9128

Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.

• CWE-79
• CWE-79

• https://github.com/revive-adserver/revive-adserver/commit/a323fd626627e8d42819fd5b7e2829196b5c54a3Patch, Third Party Advisory
• https://github.com/revive-adserver/revive-adserver/commit/e17a7ec3412ded751cda50b82338de471d656d74Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/99004Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory
• https://github.com/revive-adserver/revive-adserver/commit/a323fd626627e8d42819fd5b7e2829196b5c54a3Patch, Third Party Advisory
• https://github.com/revive-adserver/revive-adserver/commit/e17a7ec3412ded751cda50b82338de471d656d74Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/99004Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9122go-jose before 1.0.4 suffers from multiple signatures exploi…
• CVE-2016-9123go-jose before 1.0.5 suffers from a CBC-HMAC integer overflo…
• CVE-2016-9124Revive Adserver before 3.2.3 suffers from Improper Restricti…
• CVE-2016-9125Revive Adserver before 3.2.3 suffers from session fixation, …
• CVE-2016-9126Revive Adserver before 3.2.3 suffers from persistent XSS. Us…
• CVE-2016-9127Revive Adserver before 3.2.3 suffers from Cross-Site Request…
• CVE-2016-9129Revive Adserver before 3.2.3 suffers from Information Exposu…
• CVE-2016-9130Revive Adserver before 3.2.3 suffers from Persistent XSS. A …
• CVE-2016-9131named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-…7.5
• CVE-2016-9132In Botan 1.8.0 through 1.11.33, when decoding BER data an in…
• CVE-2016-9134Exponent CMS 2.3.9 suffers from a SQL injection vulnerabilit…
• CVE-2016-9135Exponent CMS 2.3.9 suffers from a SQL injection vulnerabilit…