# cve.now: Revive

The newest entries naming Revive as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-50743](https://cve.now/CVE-2026-50743.md): A CSRF vulnerability exists in the \`zone-include.php\` script in Revive Adserver 6.0.7. (CVSS 5.4)
- [CVE-2026-50745](https://cve.now/CVE-2026-50745.md): A missing sanitisation vulnerability exists with user input in the stats-video.php script. (CVSS 4.7)
- [CVE-2026-50740](https://cve.now/CVE-2026-50740.md): A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. (CVSS 6.1)
- [CVE-2026-50742](https://cve.now/CVE-2026-50742.md): A stored XSS vulnerabilities exists in the \`maintenance-acl-check.php\` and \`maintenance-banners-check.php\` tools of Revive Adserver 6.0.7. (CVSS 4.4)
- [CVE-2026-50741](https://cve.now/CVE-2026-50741.md): Bypass to the fix for CVE-2026-34916. (CVSS 8.8)
- [CVE-2026-50739](https://cve.now/CVE-2026-50739.md): A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns (CVSS 4.3)
- [CVE-2026-50744](https://cve.now/CVE-2026-50744.md): A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. (CVSS 4.3)
- [CVE-2026-34913](https://cve.now/CVE-2026-34913.md): A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl (CVSS 4.3)
- [CVE-2026-34917](https://cve.now/CVE-2026-34917.md): Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict (CVSS 4.3)
- [CVE-2026-44956](https://cve.now/CVE-2026-44956.md): Low‑privileged users could use their Full Name as a vector for a stored XSS attack. (CVSS 0.0)
- [CVE-2026-34914](https://cve.now/CVE-2026-34914.md): A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. (CVSS 8.3)
- [CVE-2026-44958](https://cve.now/CVE-2026-44958.md): An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when (CVSS 5.4)
- [CVE-2026-44961](https://cve.now/CVE-2026-44961.md): The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. (CVSS 0.0)
- [CVE-2026-44960](https://cve.now/CVE-2026-44960.md): A stored XSS can be exploited by leveraging the usernames as an attack vector. (CVSS 0.0)
- [CVE-2026-44957](https://cve.now/CVE-2026-44957.md): A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. (CVSS 4.3)
- [CVE-2026-34912](https://cve.now/CVE-2026-34912.md): A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and (CVSS 4.3)
- [CVE-2026-44959](https://cve.now/CVE-2026-44959.md): A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. (CVSS 8.8)
- [CVE-2026-34915](https://cve.now/CVE-2026-34915.md): A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t (CVSS 6.1)
- [CVE-2026-21642](https://cve.now/CVE-2026-21642.md): HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the \`banner-acl.php\` and \`channel-acl.php\` scrip (CVSS 6.1)
- [CVE-2026-21664](https://cve.now/CVE-2026-21664.md): HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Rev (CVSS 6.1)
- [CVE-2026-21663](https://cve.now/CVE-2026-21663.md): HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. (CVSS 6.1)
- [CVE-2026-21640](https://cve.now/CVE-2026-21640.md): HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. (CVSS 2.7)
- [CVE-2026-21641](https://cve.now/CVE-2026-21641.md): HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the \`tracker-delete.php\` script of Re (CVSS 7.1)
- [CVE-2025-55129](https://cve.now/CVE-2025-55129.md): HackerOne community member Kassem S.(kassem\_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatio (CVSS 5.4)
- [CVE-2025-52668](https://cve.now/CVE-2025-52668.md): Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential i (CVSS 8.7)
- [CVE-2025-48986](https://cve.now/CVE-2025-48986.md): Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email addre (CVSS 8.8)
- [CVE-2025-48987](https://cve.now/CVE-2025-48987.md): Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack. (CVSS 6.3)
- [CVE-2025-55123](https://cve.now/CVE-2025-55123.md): Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS att (CVSS 3.5)
- [CVE-2025-52671](https://cve.now/CVE-2025-52671.md): Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to a (CVSS 4.3)
- [CVE-2025-52666](https://cve.now/CVE-2025-52666.md): Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator (CVSS 2.7)
- [CVE-2025-52669](https://cve.now/CVE-2025-52669.md): Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to hav (CVSS 4.3)
- [CVE-2025-55124](https://cve.now/CVE-2025-55124.md): Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script. (CVSS 6.1)
- [CVE-2025-52670](https://cve.now/CVE-2025-52670.md): Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by ot (CVSS 7.1)
- [CVE-2025-52667](https://cve.now/CVE-2025-52667.md): Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possib (CVSS 3.5)
- [CVE-2025-55126](https://cve.now/CVE-2025-55126.md): HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advert (CVSS 6.5)
- [CVE-2025-55127](https://cve.now/CVE-2025-55127.md): HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new u (CVSS 5.4)
- [CVE-2025-55128](https://cve.now/CVE-2025-55128.md): HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php (CVSS 6.5)
- [CVE-2025-27208](https://cve.now/CVE-2025-27208.md): A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. (CVSS 6.3)
- [CVE-2025-52664](https://cve.now/CVE-2025-52664.md): SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logg (CVSS 8.8)
- [CVE-2023-38040](https://cve.now/CVE-2023-38040.md): A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. (no CVSS)
- [CVE-2019-5440](https://cve.now/CVE-2019-5440.md): Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver \< v4.2.1 causes a potential authentication b (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/revive
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.