Adserver at a glance
- Last 12 months
- 18
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 17 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
18 results · Feed
-
Medium 5.4
A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or…
-
Medium 6.1
A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and e…
-
Medium 4.4
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Rev…
-
Medium 4.7
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script …
-
Medium 4.3
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login m…
-
High 8.8
Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix…
-
Medium 4.3
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation …
-
Medium 4.3
A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Reviv…
-
High 8.3
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privile…
-
Medium 4.3
A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Ad…
-
Medium 6.1
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a …
-
Medium 4.3
Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication…
-
None 0.0
A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log …
-
Medium 5.4
An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 an…
-
Medium 4.3
A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and ear…
-
None 0.0
The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users…
-
None 0.0
Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system‑gene…
-
High 8.8
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑…