Revive-Adserver
Vulnerability activity for Revive-Adserver: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 17
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.1MediumJun 26, 2026Revive-Adserver revive adserver XSSCVE-2026-50745A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
- 4.3MediumJun 26, 2026Revive-Adserver revive adserver Auth bypass / access controlCVE-2026-50744A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.
- 5.4MediumJun 26, 2026Revive-Adserver revive adserver XSSCVE-2026-50742A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.
- 8.8HighJun 26, 2026Revive-Adserver revive adserver Code / command injectionCVE-2026-50741Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method.
- 5.4MediumJun 26, 2026Revive-Adserver revive adserver XSSCVE-2026-50740A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.
- 4.3MediumJun 26, 2026Revive-Adserver revive adserver Auth bypass / access controlCVE-2026-50739A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.
- 6.1MediumDec 17, 2025Revive-Adserver revive adserver XSSCVE-2023-53931Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to inject malicious scripts. Attackers can craft a malicious link to the banner-advanced.php endpoint with XSS payloads in prepend and append parameters to execute arbitrary JavaScript when an admin views the page.2.7% likely
- 6.1MediumNov 20, 2025Revive-Adserver revive adserver XSSCVE-2025-55124Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.
- 5.4MediumNov 20, 2025Revive-Adserver revive adserver XSSCVE-2025-55123Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.
- 4.3MediumNov 20, 2025Revive-Adserver revive adserver Information disclosureCVE-2025-52671Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.
- 6.5MediumNov 20, 2025Revive-Adserver revive adserver Auth bypass / access controlCVE-2025-52670Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts
- 4.3MediumNov 20, 2025Revive-Adserver revive adserver Information disclosureCVE-2025-52669Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.
- 5.4MediumNov 20, 2025Revive-Adserver revive adserver XSSCVE-2025-52668Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.
- 5.4MediumNov 20, 2025Revive-Adserver revive adserver XSSCVE-2025-52667Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.
- 2.7LowNov 20, 2025Revive-Adserver revive adserverCVE-2025-52666Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.
- 6.1MediumNov 20, 2025Revive-Adserver revive adserver XSSCVE-2025-48987Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.
- 8.8HighNov 20, 2025Revive-Adserver revive adserver Auth bypass / access controlCVE-2025-48986Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.
Top products
- revive adserver17 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.