Revive Adserver vulnerabilities, page 3
66 vulnerabilities
Known vulnerabilities in Revive Adserver, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2025-52671revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverDebug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.EPSS0.38%MediumCVE-2025-55123revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverImproper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.EPSS0.49%MediumCVE-2025-55124revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverImproper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.EPSS0.45%HighCVE-2025-48986revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverAuthorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.EPSS0.68%MediumCVE-2025-48987revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverImproper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.EPSS0.55%MediumCVE-2025-27208revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverA reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed.
The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.EPSS1.47%MediumCVE-2020-8142revive-adserver · revive_adserverrevive-adserver revive_adserverA security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was however possible for anyone with access to a Revive Adserver admin user interface to bypass such check and change e-email address or password of the currently logged in user by altering the form payload.The attack requires physical access to the user interface of a logged in user. If the POST payload was altered by turning the “pwold” parameter into an array, Revive Adserver would fetch and authorise the operation even if no password was provided.EPSS0.63%MediumCVE-2020-8115revive-adserver · revive_adserverrevive-adserver revive_adserverA reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.EPSS6.98%MediumCVE-2020-8143revive-adserver · revive_adserverrevive-adserver revive_adserverAn Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.EPSS70.39%MediumCVE-2014-9407revive-adserver · revive_adserverrevive-adserver revive_adserverMultiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) delete data via a request to agency-delete.php, (2) tracker-delete.php, or (3) userlog-delete.php in admin/ or (4) unlink accounts via a request to admin-user-unlink.php. (5) advertiser-user-unlink.php, or (6) affiliate-user-unlink.php in admin/.EPSS0.58%MediumCVE-2014-8875revive-adserver · revive_adserverrevive-adserver revive_adserverThe XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted XML-RPC request, aka an XML Entity Expansion (XEE) attack.EPSS2.56%MediumCVE-2014-8793revive-adserver · revive_adserverrevive-adserver revive_adserverCross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refresh_page parameter to www/admin/report-generate.php.EPSS2.31%CriticalCVE-2017-5830revive-adserver · revive_adserverrevive-adserver revive_adserverRevive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.EPSS3.30%MediumCVE-2017-5831revive-adserver · revive_adserverrevive-adserver revive_adserverSession fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.EPSS1.17%MediumCVE-2017-5833revive-adserver · revive_adserverrevive-adserver revive_adserverCross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.EPSS1.68%MediumCVE-2017-5832revive-adserver · revive_adserverrevive-adserver revive_adserverCross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address.EPSS1.33%HighCVE-2019-5440revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverUse of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an attacker exploits the password recovery functionality. In lib/OA/Dal/PasswordRecovery.php, the function generateRecoveryId() generates a password reset token that relies on the PHP uniqid function and consequently depends only on the current server time, which is often visible in an HTTP Date header.EPSS1.58%MediumCVE-2019-5433revive-adserver · revive_adserverrevive-adserver revive_adserverA user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0.EPSS1.68%MediumCVE-2026-50744revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverA bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.EPSS0.29%HighCVE-2026-50741revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverBypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method.EPSS4.94%