A reflected Cross-Site Scripting (XSS) vulnerability exists in Revive Adserver version 5.5.2. It affects the admin-search.php file via the compact parameter. An attacker can craft a URL that, when clicked by a user with access to the Revive Adserver user interface, executes injected JavaScript code in the victim's browser context. The session cookie is not accessible, but other actions may be performed. The vulnerability has a CVSS 3.0 score of 6.3, indicating medium severity.