A reflected cross-site scripting (XSS) vulnerability exists in updates-history.php in Revive Adserver versions 6.0.8 and earlier. This flaw allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability arises because attacker-controlled input is included in XML command attributes without proper encoding. The session check does not cover GET xajax requests, enabling unauthenticated exploitation, and authenticated administrator requests are also affected. The issue is resolved in version 6.0.9 by extending session checks to both GET and POST requests and encoding XML command attribute values in response serializers.