Medium severity · published Jun 26, 2026
CVE-2026-50742
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Adserver · Revive
through 6.0.7 · source: vendor
RA
Revive Adserver · Revive-adserver
before 6.0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50742
Issue Tracking
https://hackerone.com/reports/3781311
More from Adserver
8.8
CVE-2026-50741
Bypass to the fix for CVE-2026-34916
8.8
CVE-2026-44959
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier
8.3
CVE-2026-34914
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier
7.5
CVE-2023-26756
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks
6.1
CVE-2026-50745
A missing sanitisation vulnerability exists with user input in the stats-video.php script