Revive-adserver
Revive-adserver Revive Adserver: vulnerabilidades y CVE
Revive-adserver Revive Adserver tiene 67 vulnerabilidades publicadas, 20 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE67
Últimos 12 meses20
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-50745 | Media (6.1) | 0.38% | — | 26 jun 2026 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function… |
| CVE-2026-50744 | Media (4.3) | 0.29% | — | 26 jun 2026 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned… |
| CVE-2026-50742 | Media (5.4) | 0.34% | — | 26 jun 2026 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping… |
| CVE-2026-50741 | Alta (8.8) | 4.9% | — | 26 jun 2026 | Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or… |
| CVE-2026-50740 | Media (5.4) | 0.38% | — | 26 jun 2026 | A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to… |
| CVE-2026-50739 | Media (4.3) | 0.49% | — | 26 jun 2026 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver… |
| CVE-2026-34914 | Alta (8.3) | 0.39% | — | 23 jun 2026 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input… |
| CVE-2023-53931 | Media (5.1) | 2.7% | — | 17 dic 2025 | Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to inject malicious scripts. Attackers can craft a malicious link to the… |
| CVE-2025-55124 | Media (6.1) | 0.41% | — | 20 nov 2025 | Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script. |
| CVE-2025-55123 | Media (5.4) | 0.45% | — | 20 nov 2025 | Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users. |
| CVE-2025-52671 | Media (4.3) | 0.35% | — | 20 nov 2025 | Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in… |
| CVE-2025-52670 | Media (6.5) | 0.32% | — | 20 nov 2025 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts |
| CVE-2025-52669 | Media (4.3) | 0.29% | — | 20 nov 2025 | Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system. |
| CVE-2025-52668 | Media (5.4) | 0.53% | — | 20 nov 2025 | Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack. |
| CVE-2025-52667 | Media (5.4) | 0.37% | — | 20 nov 2025 | Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user. |
| CVE-2025-52666 | Baja (2.7) | 0.42% | — | 20 nov 2025 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error. |
| CVE-2025-48987 | Media (6.1) | 0.51% | — | 20 nov 2025 | Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack. |
| CVE-2025-48986 | Alta (8.8) | 0.62% | — | 20 nov 2025 | Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password… |
| CVE-2025-52664 | Alta (8.8) | 1.00% | — | 31 oct 2025 | SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users |
| CVE-2025-27208 | Media (6.1) | 1.5% | — | 31 oct 2025 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on… |
| CVE-2023-38040 | Media (6.1) | 2.1% | — | 17 sept 2023 | A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. |
| CVE-2021-22948 | Alta (7.1) | 2.7% | — | 23 sept 2021 | Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstances, an attacker could theoretically be able to brute force… |
| CVE-2021-22889 | Media (6.1) | 31% | — | 25 mar 2021 | Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a… |
| CVE-2021-22888 | Media (6.1) | 16% | — | 25 mar 2021 | Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver… |
| CVE-2021-22875 | Media (6.1) | 18% | — | 28 ene 2021 | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter. |
| CVE-2021-22874 | Media (6.1) | 18% | — | 28 ene 2021 | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter. |
| CVE-2021-22873 | Media (6.1) | 70% | — | 26 ene 2021 | Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to… |
| CVE-2021-22872 | Media (6.1) | 3.4% | — | 26 ene 2021 | Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as… |
| CVE-2021-22871 | Media (4.8) | 2.1% | — | 26 ene 2021 | Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation… |
| CVE-2020-8143 | Media (6.1) | 70% | — | 3 abr 2020 | An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them… |