GCVE-1988-2026-0376 - Vulnerability-Lookup

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0376

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55

Title

[REVIVE-SA-2026-002] Revive Adserver Vulnerabilities

Summary

======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-002 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-002 ------------------------------------------------------------------------ Date: 2026-06-03 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: <= 6.0.6 Versions not affected: >= 6.0.7 Website: https://www.revive-adserver.com/ ======================================================================== ======================================================================== 1. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-34912 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3650504 https://github.com/revive-adserver/revive-adserver/commit/e1c9b8478 https://cwe.mitre.org/data/definitions/284.html ======================================================================== 2. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-34913 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ======================================================================== Description ----------- relationships. Resolution ---------- References ---------- https://hackerone.com/reports/3650582 https://github.com/revive-adserver/revive-adserver/commit/f1b5e8504 https://cwe.mitre.org/data/definitions/284.html ======================================================================== 3. Blind SQL Injection ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-34914 Risk level: High CVSS Base Score: 8.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3653196 https://github.com/revive-adserver/revive-adserver/commit/b541d1d05 https://cwe.mitre.org/data/definitions/89.html ======================================================================== 4. Reflected XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-34915 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3653316 https://github.com/revive-adserver/revive-adserver/commit/b541d1d05 https://cwe.mitre.org/data/definitions/79.html ======================================================================== 5. Remote Code Execution ======================================================================== Vulnerability Type: CWE-94: Code Injection CVE-ID: CVE-2026-34916 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3656781 https://github.com/revive-adserver/revive-adserver/commit/de3525e12 https://cwe.mitre.org/data/definitions/94.html ======================================================================== 6. Improper Authentication ======================================================================== Vulnerability Type: CWE-287: Improper Authentication CVE-ID: CVE-2026-34917 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3672641 https://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba https://cwe.mitre.org/data/definitions/287.html ======================================================================== 7. Stored XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-44956 Risk level: Medium CVSS Base Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N ======================================================================== Description ----------- Resolution ---------- Proper escaping has been added to the userlog details output. References ---------- https://hackerone.com/reports/3669623 https://github.com/revive-adserver/revive-adserver/commit/6254115b7 https://cwe.mitre.org/data/definitions/79.html ======================================================================== 8. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-44957 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3677576 https://github.com/revive-adserver/revive-adserver/commit/5860e2f86 https://cwe.mitre.org/data/definitions/284.html ======================================================================== 9. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-44958 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3678828 https://github.com/revive-adserver/revive-adserver/commit/2af365841 https://cwe.mitre.org/data/definitions/284.html ======================================================================== 10. Remote Code Execution ======================================================================== Vulnerability Type: CWE-94: Code Injection CVE-ID: CVE-2026-44959 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ======================================================================== Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3744200 https://github.com/revive-adserver/revive-adserver/commit/6c6161420 https://cwe.mitre.org/data/definitions/94.html ======================================================================== 11. Stored XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-44960 Risk level: Medium CVSS Base Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- the username would be executed due to missing output sanitisation. Resolution ---------- Proper escaping has been added to the audit log details output. References ---------- https://hackerone.com/reports/3680090 https://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5 https://cwe.mitre.org/data/definitions/79.html ======================================================================== 12. Incomplete List of Disallowed Inputs ======================================================================== Vulnerability Type: CWE-184: Incomplete List of Disallowed Inputs CVE-ID: CVE-2026-44961 Risk level: Medium CVSS Base Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- HackerOne community member barcrange (3l4) has reported that the XML‑RPC API CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Resolution ---------- Proper validation has been added where it was missing. References ---------- https://hackerone.com/reports/3680090 https://github.com/revive-adserver/revive-adserver/commit/229cf361b https://cwe.mitre.org/data/definitions/184.html ======================================================================== Solution ======================================================================== ======================================================================== Contact Information ======================================================================== The security contact for Revive Adserver can be reached at: <security AT revive-adserver DOT com>. Please review https://www.revive-adserver.com/security/ before doing so. -- Matteo Beccati On behalf of the Revive Adserver Team https://www.revive-adserver.com/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

CWE

Assigner

VULNARCHIVE GNA-1988

References

35 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Jun/0	technical-description
https://cwe.mitre.org/data/definitions/184.html
https://cwe.mitre.org/data/definitions/284.html
https://cwe.mitre.org/data/definitions/287.html
https://cwe.mitre.org/data/definitions/79.html
https://cwe.mitre.org/data/definitions/89.html
https://cwe.mitre.org/data/definitions/94.html
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://github.com/revive-adserver/revive-adserve…
https://hackerone.com/reports/3650504
https://hackerone.com/reports/3650582
https://hackerone.com/reports/3653196
https://hackerone.com/reports/3653316
https://hackerone.com/reports/3656781
https://hackerone.com/reports/3669623
https://hackerone.com/reports/3672641
https://hackerone.com/reports/3677576
https://hackerone.com/reports/3678828
https://hackerone.com/reports/3680090
https://hackerone.com/reports/3744200
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/
https://www.revive-adserver.com/
https://www.revive-adserver.com/security/
https://www.revive-adserver.com/security/revive-s…

Impacted products

1 product

Vendor	Product	Version	CPE status
unknown	Revive Adserver Vulnerabilities	Affected: unknown	guessed

Credits

Matteo Beccati

Relationships

reference GCVE-1988-2026-0376 (this record)

related CVE-2026-34912
related CVE-2026-34913
related CVE-2026-34914
related CVE-2026-34915
related CVE-2026-34916
related CVE-2026-34917
related CVE-2026-44956
related CVE-2026-44957
related CVE-2026-44958
related CVE-2026-44959
related CVE-2026-44960
related CVE-2026-44961

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-002\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-002\n------------------------------------------------------------------------\nDate: 2026-06-03\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: \u003c= 6.0.6\nVersions not affected: \u003e= 6.0.7\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34912\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650504\nhttps://github.com/revive-adserver/revive-adserver/commit/e1c9b8478\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34913\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\nrelationships.\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650582\nhttps://github.com/revive-adserver/revive-adserver/commit/f1b5e8504\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n3. Blind SQL Injection\n========================================================================\nVulnerability Type: CWE-89: SQL Injection\nCVE-ID: CVE-2026-34914\nRisk level: High\nCVSS Base Score: 8.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653196\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/89.html\n\n\n========================================================================\n4. Reflected XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-34915\nRisk level: Medium\nCVSS Base Score: 6.1\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653316\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-34916\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3656781\nhttps://github.com/revive-adserver/revive-adserver/commit/de3525e12\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n6. Improper Authentication\n========================================================================\nVulnerability Type: CWE-287: Improper Authentication\nCVE-ID: CVE-2026-34917\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3672641\nhttps://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba\nhttps://cwe.mitre.org/data/definitions/287.html\n\n\n========================================================================\n7. Stored XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-44956\nRisk level: Medium\nCVSS Base Score: 5.4\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\nProper escaping has been added to the userlog details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3669623\nhttps://github.com/revive-adserver/revive-adserver/commit/6254115b7\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n8. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44957\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3677576\nhttps://github.com/revive-adserver/revive-adserver/commit/5860e2f86\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n9. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44958\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3678828\nhttps://github.com/revive-adserver/revive-adserver/commit/2af365841\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n10. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-44959\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3744200\nhttps://github.com/revive-adserver/revive-adserver/commit/6c6161420\nhttps://cwe.mitre.org/data/definitions/94.html\n\n========================================================================\n11. Stored XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-44960\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\nthe username would be executed due to missing output sanitisation.\n\nResolution\n----------\nProper escaping has been added to the audit log details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n12. Incomplete List of Disallowed Inputs\n========================================================================\nVulnerability Type:    CWE-184: Incomplete List of Disallowed Inputs\nCVE-ID:                CVE-2026-44961\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\nHackerOne community member barcrange (3l4) has reported that the XML\u2011RPC API\n\nCVE\u20112025\u201155129. As a result, API users could create usernames that enabled\nimpersonation or stored XSS attacks.\n\nResolution\n----------\nProper validation has been added where it was missing.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/229cf361b\nhttps://cwe.mitre.org/data/definitions/184.html\n\n\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/0"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/184.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/284.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/287.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/89.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/229cf361b"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/2af365841"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/5860e2f86"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6254115b7"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6c6161420"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/b541d1d05"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/de3525e12"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e1c9b8478"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/f1b5e8504"
        },
        {
          "url": "https://hackerone.com/reports/3650504"
        },
        {
          "url": "https://hackerone.com/reports/3650582"
        },
        {
          "url": "https://hackerone.com/reports/3653196"
        },
        {
          "url": "https://hackerone.com/reports/3653316"
        },
        {
          "url": "https://hackerone.com/reports/3656781"
        },
        {
          "url": "https://hackerone.com/reports/3669623"
        },
        {
          "url": "https://hackerone.com/reports/3672641"
        },
        {
          "url": "https://hackerone.com/reports/3677576"
        },
        {
          "url": "https://hackerone.com/reports/3678828"
        },
        {
          "url": "https://hackerone.com/reports/3680090"
        },
        {
          "url": "https://hackerone.com/reports/3744200"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-002"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-002] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34912",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34914",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34916",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44957",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44960",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44961",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0376",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0",
            "automated": true,
            "contentSha256": "38353b4aad227a84e5f5423124ed92bb9eccc2c021361c590c300ad74d739e41",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-03T13:43:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0376"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0376"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44960 (GCVE-0-2026-44960)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:14 – Updated: 2026-06-23 17:46

Summary

A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation. Proper escaping has been added to the audit log details output.

Severity

0 (None)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:45 UTC

CWE

CWE-79 - Cross-site Scripting (XSS) - Stored

Assigner

hackerone mitre root

References

1 reference

URL	Tags
https://hackerone.com/reports/3680090

Impacted products

1 product

Vendor	Product	Version
Revive	Adserver	Affected: 0 , ≤ 6.0.6 (semver)

Credits

barcrange (3l4)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44960",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:45:49.615778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:46:02.076Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Adserver",
          "vendor": "Revive",
          "versions": [
            {
              "lessThanOrEqual": "6.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "barcrange (3l4)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation. Proper escaping has been added to the audit log details output."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 0,
            "baseSeverity": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS) - Stored",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T16:14:38.124Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3680090"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-44960",
    "datePublished": "2026-06-23T16:14:38.124Z",
    "dateReserved": "2026-05-08T15:00:02.447Z",
    "dateUpdated": "2026-06-23T17:46:02.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44961 (GCVE-0-2026-44961)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:14 – Updated: 2026-06-23 17:44

Summary

The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.

Severity

0 (None)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:32 UTC

CWE

CWE-287 - Improper Authentication - Generic

Assigner

hackerone mitre root

References

1 reference

URL	Tags
https://hackerone.com/reports/3680090

Impacted products

1 product

Vendor	Product	Version
Revive	Adserver	Affected: 0 , ≤ 6.0.6 (semver)

Credits

barcrange (3l4)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:32:45.247422Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:44:07.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Adserver",
          "vendor": "Revive",
          "versions": [
            {
              "lessThanOrEqual": "6.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "barcrange (3l4)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The XML\u2011RPC API addUser method has a validation bypass introduced in the fix for CVE\u20112025\u201155129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 0,
            "baseSeverity": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T16:14:38.126Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3680090"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-44961",
    "datePublished": "2026-06-23T16:14:38.126Z",
    "dateReserved": "2026-05-08T15:00:02.447Z",
    "dateUpdated": "2026-06-23T17:44:07.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.