EUVD-2026-38500
GHSA-h4mp-fxvg-qvvr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin UI, low complexity, requires a low-privileged Revive account (PR:L), no user interaction, and stored PHP execution yields full host-process CIA impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery. Input sanitisation has been improved to ensure that unexpected parameters are filtered out.
Articles & Coverage 2
AnalysisAI
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpected parameter into the delivery limitations save flow, planting attacker-controlled PHP into the compiledlimitations field that is then evaluated when banners are served. With CVSS 8.8 and a CWE-94 root cause, successful exploitation yields full code execution under the web/ad-delivery process, though there is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV.
Technical ContextAI
Revive Adserver is an open-source PHP ad-serving platform descended from OpenX. Delivery limitations are persisted as a precompiled PHP expression in the compiledlimitations column, which the delivery engine evaluates at banner-serving time to decide whether a creative is shown. The flaw, classified as CWE-94 (Improper Control of Generation of Code), stems from accepting an unexpected component parameter during the save-limitations action and weaving its value into that compiled PHP without filtering, so attacker-controlled syntax becomes part of the code the delivery layer runs. The affected component is identified by CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*, covering all Revive Adserver versions up to and including 6.0.6.
RemediationAI
Upgrade to the Revive Adserver release that follows 6.0.6 and contains the improved input sanitisation that filters unexpected parameters out of the delivery-limitations save path; the input notes the fix conceptually but does not supply an exact patched version number, so confirm the target release against the vendor download page and the HackerOne report at https://hackerone.com/reports/3744200 before deploying. Until patched, restrict who can create or edit banner delivery limitations by limiting low-privileged advertiser/agency account provisioning, place the Revive admin UI behind VPN or IP allow-listing so untrusted users cannot reach the save endpoint, and audit the compiledlimitations column for suspicious PHP fragments before re-enabling delivery; each of these reduces attack surface at the cost of administrative overhead and, for IP allow-listing, blocking legitimate remote advertiser self-service.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today