description: Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable.
problem types: Cross-site Scripting (XSS) - Reflected (CWE-79)
affected:
{
product: https://github.com/revive-adserver/revive-adserver
vendor: n/a
versions:
status: affected, version: Fixed in 5.1.0
}