CVE-2016-9470: revive-adserver revive_adserver Cross-site Scripting
Vulnerability summary
CVE-2016-9470 is a high (CVSS 9.3) Cross-site Scripting vulnerability in revive-adserver revive_adserver. EPSS estimates a 2.10% chance of exploitation in the next 30 days, higher than 81.5% of scored vulnerabilities.
Timeline
- 28-03-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.10%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.10% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-2547PK - Security FeaturesSoftware security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Affected systems
Revive-adserver1 product
- revive_adserver≤ 3.2.4 | 4.0.0
1 vendor · 1 product