Approved changes feed: RSS · Atom
cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Revive (79fbdab7-1294-57ee-b28a-efd7ff0dfd89) |
|---|---|
| Product | Adserver (0a642ad5-bde2-5ba4-9be0-019435d0113d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/revive-adserver/revive-adserver |
purl2cpe | 2026-06-01 10:16:48.765930 |
pkg:sourceforge/phppgads |
purl2cpe | 2026-06-01 10:16:48.765933 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-50745 |
vulnerable | 2026-07-29 00:57:48.830918 |
Details available
MEDIUM (4.7)
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
Published: 2026-06-26T01:11:14.310Z
Updated: 2026-06-26T12:29:14.728Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50744 |
vulnerable | 2026-07-29 00:57:48.830806 |
Details available
MEDIUM (4.3)
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.
Published: 2026-06-26T01:11:14.060Z
Updated: 2026-06-26T12:29:47.196Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50743 |
vulnerable | 2026-07-29 00:57:48.830573 |
Details available
MEDIUM (5.4)
A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an authenticated administrator.
Published: 2026-07-20T16:53:12.618Z
Updated: 2026-07-20T18:23:49.327Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50742 |
vulnerable | 2026-07-29 00:57:48.830426 |
Details available
MEDIUM (4.4)
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.
Published: 2026-06-26T01:11:14.243Z
Updated: 2026-06-26T12:25:33.119Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50741 |
vulnerable | 2026-07-29 00:57:48.830317 |
Details available
HIGH (8.8)
Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method.
Published: 2026-06-26T01:11:14.108Z
Updated: 2026-06-26T12:27:43.548Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50740 |
vulnerable | 2026-07-29 00:57:48.830095 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50739 |
vulnerable | 2026-07-29 00:57:48.829791 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44960 |
vulnerable | 2026-07-29 00:52:14.943278 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44956 |
vulnerable | 2026-07-29 00:52:14.942865 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34917 |
vulnerable | 2026-07-29 00:43:24.898848 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34914 |
vulnerable | 2026-07-29 00:43:24.893651 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34913 |
vulnerable | 2026-07-29 00:43:24.893343 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.