RE
Vendor
Revive
41
CVEs
0
On KEV
0
New 30D
Products
RA8.8
Revive Adserver
Revive
21 CVEs0 on KEV0 new
AD8.8
Adserver
Revive
19 CVEs0 on KEV0 new
RO7.2
Revive Old Posts
Revive
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-50743 | AD Adserver Revive | 5.4 | Jul 20 | A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7 |
| CVE-2026-50745 | AD Adserver Revive | 6.1 | Jun 26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script |
| CVE-2026-50740 | AD Adserver Revive | 5.4 | Jun 26 | A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier |
| CVE-2026-50742 | AD Adserver Revive | 5.4 | Jun 26 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7 |
| CVE-2026-50741 | AD Adserver Revive | 8.8 | Jun 26 | Bypass to the fix for CVE-2026-34916 |
| CVE-2026-50739 | AD Adserver Revive | 4.3 | Jun 26 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the… |
| CVE-2026-50744 | AD Adserver Revive | 4.3 | Jun 26 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7 |
| CVE-2026-34913 | AD Adserver Revive | 4.3 | Jun 23 | A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user… |
| CVE-2026-34917 | AD Adserver Revive | 4.3 | Jun 23 | Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users |
| CVE-2026-44956 | AD Adserver Revive | 0.0 | Jun 23 | Low‑privileged users could use their Full Name as a vector for a stored XSS attack |
| CVE-2026-34914 | AD Adserver Revive | 8.3 | Jun 23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier |
| CVE-2026-44958 | AD Adserver Revive | 5.4 | Jun 23 | An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted |
| CVE-2026-44961 | AD Adserver Revive | 0.0 | Jun 23 | The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129 |
| CVE-2026-44960 | AD Adserver Revive | 0.0 | Jun 23 | A stored XSS can be exploited by leveraging the usernames as an attack vector |
| CVE-2026-44957 | AD Adserver Revive | 4.3 | Jun 23 | A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier |
| CVE-2026-34912 | AD Adserver Revive | 4.3 | Jun 23 | A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a… |
| CVE-2026-44959 | AD Adserver Revive | 8.8 | Jun 23 | A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier |
| CVE-2026-34915 | AD Adserver Revive | 6.1 | Jun 23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to… |
| CVE-2026-21642 | RA Revive Adserver Revive | 6.1 | Jan 20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver |
| CVE-2026-21664 | RA Revive Adserver Revive | 6.1 | Jan 20 | HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver |
| CVE-2026-21663 | RA Revive Adserver Revive | 6.1 | Jan 20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver |
| CVE-2026-21640 | RA Revive Adserver Revive | 2.7 | Jan 20 | HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings |
| CVE-2026-21641 | RA Revive Adserver Revive | 6.5 | Jan 20 | HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver |
| CVE-2025-55129 | RA Revive Adserver Revive | 5.4 | Dec 2 | HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for… |
| CVE-2025-52668 | RA Revive Adserver Revive | 5.4 | Nov 20 | Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session… |
| CVE-2025-48986 | RA Revive Adserver Revive | 8.8 | Nov 20 | Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their… |
| CVE-2025-48987 | RA Revive Adserver Revive | 6.1 | Nov 20 | Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack |
| CVE-2025-55123 | RA Revive Adserver Revive | 5.4 | Nov 20 | Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users |
| CVE-2025-52671 | RA Revive Adserver Revive | 4.3 | Nov 20 | Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software,… |
| CVE-2025-52666 | RA Revive Adserver Revive | 2.7 | Nov 20 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console… |
| CVE-2025-52669 | RA Revive Adserver Revive | 4.3 | Nov 20 | Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email… |
| CVE-2025-55124 | RA Revive Adserver Revive | 6.1 | Nov 20 | Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script |
| CVE-2025-52670 | RA Revive Adserver Revive | 6.5 | Nov 20 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts |
| CVE-2025-52667 | RA Revive Adserver Revive | 5.4 | Nov 20 | Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user |
| CVE-2025-55126 | RA Revive Adserver Revive | 6.5 | Nov 20 | HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages, with campaign names… |
| CVE-2025-55127 | RA Revive Adserver Revive | 5.4 | Nov 20 | HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users |
| CVE-2025-55128 | RA Revive Adserver Revive | 6.5 | Nov 20 | HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php” |
| CVE-2025-27208 | RA Revive Adserver Revive | 6.1 | Oct 30 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2 |
| CVE-2025-52664 | RA Revive Adserver Revive | 8.8 | Oct 30 | SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users |
| CVE-2023-26756 | AD Adserver Revive | 7.5 | Apr 14 | The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks |
| CVE-2022-4680 | RO Revive Old Posts Revive | 7.2 | Jan 30 | The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object… |