Revive Adserver CVE-2026-44956

EUVD-2026-38508 NONE

Cross-site Scripting (XSS) (CWE-79)

2026-06-23 hackerone

GHSA-55h8-q58m-2332

PHP XSS Adserver Revive

Severity by source

Vendor (hackerone) PRIMARY

0.0 NONE

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

vuln.today AI

5.4 MEDIUM

Low-privileged account required to inject payload (PR:L), admin must actively view log page (UI:R), execution crosses to admin privilege context (S:C), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:10 vuln.today

DescriptionCVE.org

Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system‑generated emails, whose content is stored in the details field of the userlog table. An admin user viewing the email content through userlog-details.php would have any malicious JavaScript payload executed due to missing output sanitisation. Proper escaping has been added to the userlog details output.

AnalysisAI

Stored XSS in Revive Adserver allows a low-privileged user to inject malicious JavaScript through their Full Name field, which propagates via system-generated emails into the userlog table and executes in an administrator's browser when viewing userlog-details.php. The attack crosses privilege boundaries - a standard user account becomes a vector for admin-context script execution, enabling session hijacking or unauthorized privileged actions. No public exploit has been identified at time of analysis; a fix adding proper output escaping has been confirmed via HackerOne report #3669623.

Technical ContextAI

Revive Adserver is an open-source PHP-based ad serving platform (CPE: cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*), formerly known as OpenX Source, used by organizations self-hosting their digital ad delivery infrastructure. The vulnerability is a classic CWE-79 (Stored Cross-Site Scripting) rooted in a missing output-encoding step: user-supplied input from the Full Name profile field is embedded unsanitized into system-generated email content, which is subsequently persisted verbatim in the details column of the userlog database table. The administrative page userlog-details.php renders these stored details without HTML-escaping, causing any embedded script payloads to execute in the DOM context of the authenticated admin session. The fix was applied at the output layer of userlog-details.php by adding proper HTML escaping to the details rendering path.

RemediationAI

Upstream fix available per HackerOne report #3669623, which confirms that proper HTML escaping was added to the userlog details output in userlog-details.php; however, the specific patched release version is not independently confirmed from available data - operators should consult the official Revive Adserver release page and the HackerOne report at https://hackerone.com/reports/3669623 to identify the exact fixed build and apply it immediately. As a compensating control prior to patching, restrict access to userlog-details.php at the web server or firewall level to trusted internal IP ranges or VPN, preventing external attackers from triggering admin-side execution even if a payload is already stored - note this does not remove persisted payloads from the database. Additionally, enforce server-side input validation on the Full Name field to reject HTML special characters at submission time, though this should be implemented carefully to avoid breaking international name formats. Administrators should audit existing userlog entries for injected script content before patching, as stored payloads persist in the database until cleared or sanitized.