Revive vulnerabilities
41 CVEs and advisories name Revive as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-50743A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7.
- CVE-2026-50745A missing sanitisation vulnerability exists with user input in the stats-video.php script.
- CVE-2026-50740A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier.
- CVE-2026-50742A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7.
- CVE-2026-50741Bypass to the fix for CVE-2026-34916.
- CVE-2026-50739A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns
- CVE-2026-50744A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7.
- CVE-2026-34913A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl
- CVE-2026-34917Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict
- CVE-2026-44956Low‑privileged users could use their Full Name as a vector for a stored XSS attack.
- CVE-2026-34914A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier.
- CVE-2026-44958An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when
- CVE-2026-44961The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129.
- CVE-2026-44960A stored XSS can be exploited by leveraging the usernames as an attack vector.
- CVE-2026-44957A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier.
- CVE-2026-34912A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and
- CVE-2026-44959A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier.
- CVE-2026-34915A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t
- CVE-2026-21642HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scrip
- CVE-2026-21664HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Rev
- CVE-2026-21663HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver.
- CVE-2026-21640HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings.
- CVE-2026-21641HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Re
- CVE-2025-55129HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatio
- CVE-2025-52668Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential i
- CVE-2025-48986Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email addre
- CVE-2025-48987Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.
- CVE-2025-55123Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS att
- CVE-2025-52671Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to a
- CVE-2025-52666Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator