https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 23:38:33 +0000 https://db.gcve.eu/vuln/cve-2026-77168 <p><strong>Affected:</strong> Revive Adserver</p> <p>A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker&#39;s name, description or advertiser assignment using an authenticated victim&#39;s permissions. A leftover state-changing handler accepts request parameters without verifying a CSRF token, although it is not used by the normal invocation-tag interface. Exploitation requires victim interaction and a request path that carries the victim&#39;s session credentials. The issue is fixed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler.</p> <p><strong>Affected:</strong> Revive Adserver</p> <p>A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker&#39;s name, description or advertiser assignment using an authenticated victim&#39;s permissions. A leftover state-changing handler accepts request parameters without verifying a CSRF token, although it is not used by the normal invocation-tag interface. Exploitation requires victim interaction and a request path that carries the victim&#39;s session credentials. The issue is fixed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler.</p> https://db.gcve.eu/vuln/cve-2026-77168