CVE-2026-34914: revive adserver SQL Injection
CVSS: 8.3v3.0HighDeferred
Published 23-06-2026Last modified 23-06-2026
Vulnerability summary
CVE-2026-34914 is a high (CVSS 8.3) SQL Injection vulnerability in revive adserver. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.6% of scored vulnerabilities.
CVSS score
8.3/10
010
High · v3.0 (CVE.org)EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 23-06-2026PublishedVulnerability first disclosed.
- 23-06-2026Last modifiedVulnerability information updated.
Description
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 8.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:HSourcesAll 2 agree
- NVDNIST8.3HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 22-09-2026
22-09-202622-10-2026
EPSS score0.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Revive1 product
- adserver≤ 6.0.6
1 vendor · 1 product