Revive Revive Adserver
23 CVEs affecting Revive Revive Adserver. Latest disclosed: 2026-01-20. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48986 | High | 8.8 | 2025-11-20 | Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy t… |
CVE-2025-52664 | High | 8.8 | 2025-10-31 | SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users |
CVE-2019-5440 | High | 8.1 | 2019-05-28 | Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an… |
CVE-2026-21641 | Medium | 6.5 | 2026-01-20 | HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. User… |
CVE-2025-52670 | Medium | 6.5 | 2025-11-20 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts |
CVE-2025-55128 | Medium | 6.5 | 2025-11-20 | HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with… |
CVE-2025-55126 | Medium | 6.5 | 2025-11-20 | HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages… |
CVE-2026-21664 | Medium | 6.1 | 2026-01-20 | HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An at… |
CVE-2026-21663 | Medium | 6.1 | 2026-01-20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft… |
CVE-2026-21642 | Medium | 6.1 | 2026-01-20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserv… |
CVE-2025-55124 | Medium | 6.1 | 2025-11-20 | Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script. |
CVE-2025-48987 | Medium | 6.1 | 2025-11-20 | Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack. |
CVE-2025-27208 | Medium | 6.1 | 2025-10-31 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the us… |
CVE-2023-38040 | Medium | 6.1 | 2023-09-17 | A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. |
CVE-2025-55129 | Medium | 5.4 | 2025-12-02 | HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the… |
CVE-2025-55123 | Medium | 5.4 | 2025-11-20 | Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own a… |
CVE-2025-52668 | Medium | 5.4 | 2025-11-20 | Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosu… |
CVE-2025-52667 | Medium | 5.4 | 2025-11-20 | Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in… |
CVE-2025-55127 | Medium | 5.4 | 2025-11-20 | HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username wi… |
CVE-2025-52671 | Medium | 4.3 | 2025-11-20 | Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information… |