Revive-adserver Revive_adserver
66 CVEs affecting Revive-adserver Revive_adserver. Latest disclosed: 2026-06-26. Critical: 4, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9125 | Critical | 9.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating t… |
CVE-2016-9124 | Critical | 9.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to passwor… |
CVE-2017-5830 | Critical | 9.8 | 2017-03-03 | Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts. |
CVE-2016-9470 | Critical | 9.0 | 2017-03-28 | Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Downlo… |
CVE-2026-50741 | High | 8.8 | 2026-06-26 | Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a dis… |
CVE-2025-48986 | High | 8.8 | 2025-11-20 | Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy t… |
CVE-2025-52664 | High | 8.8 | 2025-10-31 | SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users |
CVE-2016-9456 | High | 8.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts… |
CVE-2016-9455 | High | 8.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF att… |
CVE-2016-9127 | High | 8.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This… |
CVE-2019-5440 | High | 8.1 | 2019-05-28 | Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an… |
CVE-2021-22948 | High | 7.1 | 2021-09-23 | Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstan… |
CVE-2020-8142 | Medium | 6.8 | 2020-04-03 | A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many othe… |
CVE-2025-52670 | Medium | 6.5 | 2025-11-20 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts |
CVE-2026-50745 | Medium | 6.1 | 2026-06-26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best pra… |
CVE-2023-53931 | Medium | 6.1 | 2025-12-17 | Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to inject malicious scripts… |
CVE-2025-55124 | Medium | 6.1 | 2025-11-20 | Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script. |
CVE-2025-48987 | Medium | 6.1 | 2025-11-20 | Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack. |
CVE-2025-27208 | Medium | 6.1 | 2025-10-31 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the us… |
CVE-2023-38040 | Medium | 6.1 | 2023-09-17 | A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. |