Revive Adserver vulnerabilities, page 4
66 vulnerabilities
Known vulnerabilities in Revive Adserver products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
MediumCVE-2026-50742revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverA stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.EPSS0.34%MediumCVE-2026-50739revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverA bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.EPSS0.49%MediumCVE-2026-50740revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverA missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.EPSS0.38%MediumCVE-2026-50745revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverA missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.EPSS0.38%MediumCVE-2023-53931revive-adserver · revive_adserver +1 moreRevive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced SettingsRevive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to inject malicious scripts. Attackers can craft a malicious link to the banner-advanced.php endpoint with XSS payloads in prepend and append parameters to execute arbitrary JavaScript when an admin views the page.EPSS2.75%MediumCVE-2023-38040revive-adserver · revive_adserver +1 morerevive-adserver revive_adserverA reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..EPSS2.07%