Revive Adserver vulnerabilities

• revive adserver A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking... CVE-2026-50743 5.4 MediumJuly 20, 2026
• revive adserver, revive-adserver revive adserver +1 more A missing sanitisation vulnerability exists with user input in the stats-video.php script. The... CVE-2026-50745 4.7 MediumJune 26, 2026
• revive adserver, revive-adserver revive adserver +1 more A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API... CVE-2026-50744 4.3 MediumJune 26, 2026
• revive adserver, revive-adserver revive adserver +1 more A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners... CVE-2026-50742 4.4 MediumJune 26, 2026
• revive adserver, revive-adserver revive adserver +1 more Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio... CVE-2026-50741 8.8 HighJune 26, 2026
• revive adserver, revive-adserver revive adserver +1 more A missing sanitisation vulnerability of user input in the zone-include.php script exists in... CVE-2026-50740 6.1 MediumJune 26, 2026
• revive adserver, revive-adserver revive adserver +1 more A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to... CVE-2026-50739 4.3 MediumJune 26, 2026
• revive adserver The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129.... CVE-2026-44961 0.0 NoneJune 23, 2026
• revive adserver A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user... CVE-2026-44960 0.0 NoneJune 23, 2026
• revive adserver A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0... CVE-2026-44959 8.8 HighJune 23, 2026
• revive adserver An access control bypass allows an advertiser‑level user to activate or deactivate a banner in... CVE-2026-44958 5.4 MediumJune 23, 2026
• revive adserver A missing access control check when invoking various modify methods in the XML‑RPC API of Revive... CVE-2026-44957 4.3 MediumJune 23, 2026
• revive adserver Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is... CVE-2026-44956 0.0 NoneJune 23, 2026
• revive adserver Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API... CVE-2026-34917 4.3 MediumJune 23, 2026
• revive adserver A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and... CVE-2026-34916 8.8 HighJune 23, 2026
• revive adserver A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and... CVE-2026-34915 6.1 MediumJune 23, 2026
• revive adserver A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and... CVE-2026-34914 8.3 HighJune 23, 2026
• revive adserver A missing access control check when linking trackers to campaigns through the campaign-trackers... CVE-2026-34913 4.3 MediumJune 23, 2026
• revive adserver A missing access control check when linking banners or campaigns to a zone through the zone... CVE-2026-34912 4.3 MediumJune 23, 2026
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the ... CVE-2026-21642 6.1 MediumJanuary 20, 2026
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS... CVE-2026-21664 6.1 MediumJanuary 20, 2026
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the... CVE-2026-21663 6.1 MediumJanuary 20, 2026
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass... CVE-2026-21641 7.1 HighJanuary 20, 2026
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in... CVE-2026-21640 2.7 LowJanuary 20, 2026
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive... CVE-2025-55129 5.4 MediumDecember 2, 2025
• revive adserver, revive-adserver revive adserver +1 more Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6... CVE-2025-52668 8.7 HighNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a... CVE-2025-48987 6.3 MediumNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in... CVE-2025-48986 8.8 HighNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the... CVE-2025-55124 6.1 MediumNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes... CVE-2025-55123 3.5 LowNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and... CVE-2025-52671 4.3 MediumNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users... CVE-2025-52670 7.1 HighNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and... CVE-2025-52669 4.3 MediumNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier... CVE-2025-52667 3.5 LowNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1... CVE-2025-52666 2.7 LowNovember 20, 2025
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability... CVE-2025-55126 6.5 MediumNovember 20, 2025
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of... CVE-2025-55127 5.4 MediumNovember 20, 2025
• aquaplatform revive adserver, revive adserver +1 more HackerOne community member Dao Hoang Anh (yoyomiski) has reported an uncontrolled resource... CVE-2025-55128 6.5 MediumNovember 20, 2025
• revive adserver, revive-adserver revive adserver +1 more A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver... CVE-2025-27208 6.3 MediumOctober 30, 2025
• revive adserver, revive-adserver revive adserver +1 more SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when... CVE-2025-52664 8.8 HighOctober 30, 2025
• revive adserver, revive-adserver revive adserver +1 more A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. CVE-2023-38040 6.1 MediumSeptember 17, 2023
• revive adserver The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. CVE-2023-26756 Disputed 7.5 HighApril 14, 2023
• revive adserver, revive-adserver revive adserver +1 more Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver <... CVE-2019-5440 8.1 HighMay 28, 2019
• revive adserver, revive-sas revive adserver +1 more An attacker could send a specifically crafted payload to the XML-RPC invocation script and... CVE-2019-5434 Public exploit EPSS 57.0% 9.8 CriticalMay 6, 2019
• revive adserver, revive-adserver revive adserver +1 more A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a... CVE-2019-5433 5.4 MediumMay 6, 2019