CVE-2020-8115

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.

• CWE-79
• CWE-79

• https://hackerone.com/reports/775693Exploit, Patch, Third Party Advisory
• https://www.revive-adserver.com/security/revive-sa-2020-001/Vendor Advisory
• https://hackerone.com/reports/775693Exploit, Patch, Third Party Advisory
• https://www.revive-adserver.com/security/revive-sa-2020-001/Vendor Advisory

Published

Feb 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8109A vulnerability has been discovered in the ace.xmd parser th…7.5
• CVE-2020-8110A vulnerability has been discovered in the ceva_emu.cvd modu…7.5
• CVE-2020-8111Rejected reason: Unused CVE for 2020
• CVE-2020-8112opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3…8.8
• CVE-2020-8113GitLab 10.7 and later through 12.7.2 has Incorrect Access Co…9.8
• CVE-2020-8114GitLab EE 8.9 and later through 12.7.2 has Insecure Permissi…9.8
• CVE-2020-8116Prototype pollution vulnerability in dot-prop npm package ve…7.3
• CVE-2020-8117Improper preservation of permissions in Nextcloud Server 14.…4.3
• CVE-2020-8118An authenticated server-side request forgery in Nextcloud se…5
• CVE-2020-8119Improper authorization in Nextcloud server 17.0.0 causes lea…4.3
• CVE-2020-8120A reflected Cross-Site Scripting vulnerability in Nextcloud …6.1
• CVE-2020-8121A bug in Nextcloud Server 14.0.4 could expose more data in r…8.1