CVE-2016-9128 - AskarLabs CVE Database

CVE-2016-9128

Vendor N/A

Product Revive Adserver All versions before 3.2.3

Weakness CWE-79 · XSS

Published March 28, 2017

Last update August 6, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.

Key dates

02Disclosure timeline

March 28, 2017 CVE published

August 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2016-9128 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-49875 WordPress If-So Dynamic Content Personalization plugin <= 1.9.3.1 - Cross Site Scripting (XSS) Vulnerability CVE-2026-24988 WordPress The Events Calendar Shortcode & Block plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2023-38384 WordPress eaSYNC Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) CVE-2025-53215 WordPress Yahoo! WebPlayer Plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability CVE-2024-34000 moodle: stored XSS in lesson overview report via user ID number