CVE-2025-55123
MEDIUMCVSS 5.4/10EPSS 0.38%
Last modified
CVE-2025-55123 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Revive-Adserver | Revive Adserver | 6.0.0 |
References
- https://hackerone.com/reports/3404968Exploit, Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/3404968Exploit, Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-55123?
Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.
How severe is CVE-2025-55123?
CVE-2025-55123 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 0.38% probability of exploitation in the next 30 days.
How do I fix CVE-2025-55123?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-55114The improper order of AUTHORIZED_CTM_IP validation in the Co…6.9
- CVE-2025-55115A path traversal in the Control-M/Agent can lead to a local …9.3
- CVE-2025-55116A buffer overflow in the Control-M/Agent can lead to a local…9.3
- CVE-2025-55117A stack-based buffer overflow can be remotely triggered when…6.3
- CVE-2025-55118Memory corruptions can be remotely triggered in the Control-…8.9
- CVE-2025-5512A vulnerability, which was classified as critical, was found…9.8
- CVE-2025-55124Improper neutralisation of input in Revive Adserver 6.0.0+ c…6.1
- CVE-2025-55125This vulnerability allows a Backup or Tape Operator to perfo…9.8
- CVE-2025-55126HackerOne community member Dang Hung Vi (vidang04) has repor…6.5
- CVE-2025-55127HackerOne community member Dao Hoang Anh (yoyomiski) has rep…5.4
- CVE-2025-55128HackerOne community member Dang Hung Vi (vidang04) has repor…6.5
- CVE-2025-55129HackerOne community member Kassem S.(kassem_s94) has reporte…5.4
Are you affected by CVE-2025-55123?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST