RE
Product
revive-adserver
67
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 9Medium 37Low 2
Watch
Add revive-adserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9125 | 9.8 | Mar 28 | Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session… Affected: through 3.2.2 |
| CVE-2016-9124 | 9.8 | Mar 28 | Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts Affected: through 3.2.2 |
| CVE-2017-5830 | 9.8 | Mar 3 | Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts Affected: through 4.0.0 |
| CVE-2016-9470 | 9.0 | Mar 28 | Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download Affected: through 3.2.4; 4.0.0 |
| CVE-2026-50741 | 8.8 | Jun 26 | Bypass to the fix for CVE-2026-34916 Affected: before 6.0.8 |
| CVE-2026-34916 | 8.8 | Jun 23 | A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject… Affected: through 6.0.6 |
| CVE-2025-48986 | 8.8 | Nov 20 | Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their… Affected: through 5.5.2; 6.0.0 through 6.0.1 |
| CVE-2025-52664 | 8.8 | Oct 30 | SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users Affected: 6.0.0 |
| CVE-2016-9456 | 8.8 | Mar 28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF) Affected: through 3.2.2 |
| CVE-2016-9455 | 8.8 | Mar 28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF) Affected: through 3.2.2 |
| CVE-2016-9127 | 8.8 | Mar 28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF) Affected: through 3.2.2 |
| CVE-2019-5440 | 8.1 | May 28 | Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an attacker exploits… Affected: before 4.2.1 |
| CVE-2021-22948 | 7.1 | Sep 23 | Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function Affected: before 5.3.0; 5.3.0 |
| CVE-2020-8142 | 6.8 | Apr 3 | A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144 Affected: before 5.0.5 |
| CVE-2025-52670 | 6.5 | Nov 20 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts Affected: through 5.5.2; 6.0.0 through 6.0.1 |
| CVE-2026-50745 | 6.1 | Jun 26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script Affected: before 6.0.8 |
| CVE-2023-53931 | 6.1 | Dec 17 | Revive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced Settings Affected: 5.4.1 |
| CVE-2025-48987 | 6.1 | Nov 20 | Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack Affected: through 5.5.2; 6.0.0 through 6.0.1 |
| CVE-2025-55124 | 6.1 | Nov 20 | Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script Affected: 6.0.0 through 6.0.1 |
| CVE-2025-27208 | 6.1 | Oct 30 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2 Affected: before 6.0.0; 6.0.0 |
| CVE-2023-38040 | 6.1 | Sep 17 | A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions Affected: through 5.4.1 |
| CVE-2021-22889 | 6.1 | Mar 25 | Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not… Affected: before 5.2.0 |
| CVE-2021-22888 | 6.1 | Mar 25 | Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php Affected: before 5.2.0 |
| CVE-2021-22875 | 6.1 | Jan 28 | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter Affected: before 5.1.1 |
| CVE-2021-22874 | 6.1 | Jan 28 | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter Affected: before 5.1.1 |
| CVE-2021-22873 | 6.1 | Jan 26 | Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts Affected: before 5.1.0 |
| CVE-2021-22872 | 6.1 | Jan 26 | Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script Affected: before 5.1.0 |
| CVE-2020-8143 | 6.1 | Apr 3 | An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144 Affected: before 5.0.5 |
| CVE-2020-8115 | 6.1 | Feb 4 | A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi Affected: through 5.0.3 |
| CVE-2017-5833 | 6.1 | Mar 3 | Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web… Affected: through 4.0.0 |
| CVE-2017-5831 | 5.9 | Mar 3 | Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via… Affected: through 4.0.0 |
| CVE-2026-50740 | 5.4 | Jun 26 | A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier Affected: before 6.0.8 |
| CVE-2026-50742 | 5.4 | Jun 26 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7 Affected: before 6.0.8 |
| CVE-2025-52668 | 5.4 | Nov 20 | Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session… Affected: through 5.5.2; 6.0.0 through 6.0.1 |
| CVE-2025-55123 | 5.4 | Nov 20 | Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users Affected: 6.0.0 |
| CVE-2025-52667 | 5.4 | Nov 20 | Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user Affected: through 5.5.2; 6.0.0 through 6.0.1 |
| CVE-2019-5433 | 5.4 | May 6 | A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them… Affected: before 4.2.0 |
| CVE-2016-9472 | 5.4 | Mar 28 | Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS Affected: through 3.2.4; 4.0.0 |
| CVE-2016-9457 | 5.4 | Mar 28 | Revive Adserver before 3.2.3 suffers from Reflected XSS Affected: through 3.2.2 |
| CVE-2016-9454 | 5.4 | Mar 28 | Revive Adserver before 3.2.3 suffers from Persistent XSS Affected: through 3.2.2 |
| CVE-2016-9130 | 5.4 | Mar 28 | Revive Adserver before 3.2.3 suffers from Persistent XSS Affected: through 3.2.2 |
| CVE-2016-9128 | 5.4 | Mar 28 | Revive Adserver before 3.2.3 suffers from reflected XSS Affected: through 3.2.2 |
| CVE-2016-9126 | 5.4 | Mar 28 | Revive Adserver before 3.2.3 suffers from persistent XSS Affected: through 3.2.2 |
| CVE-2017-5832 | 5.4 | Mar 3 | Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address Affected: through 4.0.0 |
| CVE-2016-9129 | 5.3 | Mar 28 | Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy Affected: through 3.2.2 |
| CVE-2021-22871 | 4.8 | Jan 26 | Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the… Affected: before 5.1.0 |
| CVE-2026-50739 | 4.3 | Jun 26 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the… Affected: before 6.0.8 |
| CVE-2026-50744 | 4.3 | Jun 26 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7 Affected: before 6.0.8 |
| CVE-2025-52671 | 4.3 | Nov 20 | Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software,… Affected: 6.0.0 |
| CVE-2025-52669 | 4.3 | Nov 20 | Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email… Affected: through 5.5.2; 6.0.0 through 6.0.1 |