Revive Adserver

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorAquaplatform (16d369fd-84b7-5db2-8064-eed30c76351d)
ProductRevive Adserver (ce7c2a0f-3057-51e7-82e8-295705cbc610)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-21664 vulnerable 2026-06-08 07:49:16.676932 Details available
MEDIUM (6.1)
HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Published: 2026-01-20T20:48:47.976Z
Updated: 2026-01-21T20:45:35.234Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-21663 vulnerable 2026-06-08 07:49:16.676686 Details available
MEDIUM (6.1)
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Published: 2026-01-20T20:48:47.974Z
Updated: 2026-01-21T20:42:21.072Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-21642 vulnerable 2026-06-08 07:49:16.665726 Details available
MEDIUM (6.1)
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Published: 2026-01-20T20:48:48.079Z
Updated: 2026-01-21T20:47:21.691Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-21641 vulnerable 2026-06-08 07:49:16.665374 Details available
HIGH (7.1)
HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.
Published: 2026-01-20T20:48:47.885Z
Updated: 2026-01-21T18:52:48.506Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-21640 vulnerable 2026-06-08 07:49:16.664788 Details available
LOW (2.7)
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.
Published: 2026-01-20T20:48:47.940Z
Updated: 2026-01-21T18:52:43.635Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-55129 vulnerable 2026-06-08 07:33:14.094653 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-55128 vulnerable 2026-06-08 07:33:14.094399 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-55127 vulnerable 2026-06-08 07:33:14.093969 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-55126 vulnerable 2026-06-08 07:33:14.093605 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.