What is the CVSS score of CVE-2026-34914?

CVE-2026-34914 has a CVSS 3.0 base score of 8.3 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Revive Adserver are affected by CVE-2026-34914?

Revive Adserver 6.0.6 and earlier contains a blind SQL injection vulnerability accessible to any employee with a standard user account, enabling them to access and modify advertiser targeting data,…

How to fix or mitigate CVE-2026-34914?

Within 24 hours: Document all Revive Adserver deployments, verify version 6.0.6 or earlier is running, and disable all non-essential user accounts. Within 7 days: Deploy Web Application Firewall rules to block SQL injection patterns in clientid parameters; implement enhanced database query logging and alerting. Within 30 days: Monitor vendor security advisories for availability of Revive Adserver 6.0.7 or later; conduct full forensic review of ad-server database for unauthorized modifications; test and deploy patched version when available.

Revive Adserver CVE-2026-34914

EUVD-2026-38506 HIGH

SQL Injection (CWE-89)

2026-06-23 hackerone

GHSA-q424-fqmp-rc8v

PHP SQLi Adserver Revive

8.3

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable web app, low-complexity blind SQLi, requires any authenticated low-priv account (PR:L), no UI; blind read limits C to L while writes give I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:02 vuln.today

DescriptionCVE.org

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.

Articles & Coverage 2

News 4 New PHP Vulnerabilities - 4 High Severity, No Public POC Jun 24, 2026 News 3 New PHP Vulnerabilities - 3 High Severity Jun 23, 2026

AnalysisAI

Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary SQL through the clientid parameter of zone-include.php due to missing input sanitisation. The flaw, rated CVSS 8.3 with PR:L, enables attackers with any valid account to exfiltrate or tamper with ad-server data; no public exploit identified at time of analysis, though a HackerOne report describing the issue is publicly referenced.

Technical ContextAI

Revive Adserver is an open-source PHP/MySQL ad management platform (forked from OpenX) widely used by publishers to deliver and track display advertising. The affected component, zone-include.php, builds SQL queries that incorporate the clientid request parameter without proper validation or parameterisation, matching the CWE-89 'Improper Neutralization of Special Elements used in an SQL Command' weakness class. Because the injection point returns no direct query output to the client, it manifests as a blind SQLi - exploitable via boolean-based or time-based inference techniques against the underlying MySQL/MariaDB datastore identified by the CPE cpe:2.3:a:revive:adserver:*.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed from the supplied references, so administrators should upgrade to the first Revive Adserver release published after 6.0.6 once announced on revive-adserver.com and cross-referenced against the HackerOne disclosure at https://hackerone.com/reports/3653196. Until the patched build is deployed, compensating controls include revoking or tightening low-privileged accounts that do not require zone-include.php access, placing the admin/delivery interface behind a WAF rule that rejects SQL metacharacters or non-numeric values in the clientid parameter (trade-off: may break legitimate non-integer client identifiers if any exist), and restricting database privileges of the Revive MySQL user to the minimum schema needed (preventing INTO OUTFILE, cross-database reads, and DDL) to blunt the integrity/availability impact if exploited.