Revive Adserver versions 6.0.8 and earlier contain a stored cross-site scripting (XSS) vulnerability in the maintenance-appendcode-check.php script. This flaw allows an authenticated manager to inject malicious JavaScript by storing a crafted tracker name that appears in the maintenance results page. When an administrator views this page, the injected script executes in their browser due to improper HTML encoding. The vulnerability is addressed in version 6.0.9 by properly encoding tracker names in the maintenance output.