EUVD-2026-38503
GHSA-x9c4-8c9x-8j5h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Low-privilege account needed to set malicious username (PR:L); admin must view audit log details (UI:R); payload executes in admin browser scope (S:C); session and integrity fully compromised (C:H/I:H); no availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation. Proper escaping has been added to the audit log details output.
AnalysisAI
Stored XSS in Revive Adserver allows arbitrary JavaScript execution in an administrator's browser by embedding payloads in usernames that are later rendered unsanitized in the audit log details view. The attack persists in the platform's audit trail and fires when any admin reviews the affected log entries - a routine administrative activity, not a rare or unusual trigger. No public exploit has been identified at time of analysis, but the vendor has confirmed a fix by adding proper HTML output escaping to the audit log details rendering path.
Technical ContextAI
Revive Adserver (cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*) is an open-source ad-serving platform descended from OpenX, used by publishers and small ad networks to manage and deliver display advertising. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). The root cause is a classic stored XSS pattern: the audit log detail rendering component inserts a username value into the HTML output without HTML-encoding it, allowing any script content in that username to be interpreted and executed by the browser. The provided CVSS base vector lists all impact metrics as N (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N), which is a null placeholder carrying a score of 0.0 and does not reflect the actual impact of stored XSS against an admin-privileged session.
RemediationAI
The vendor has addressed the vulnerability by adding proper HTML output escaping to the audit log details rendering path. Administrators should upgrade Revive Adserver to the latest available release as soon as the patched version is confirmed; the HackerOne report at https://hackerone.com/reports/3680090 should be monitored for the specific patched version number, which was not independently confirmed from the data available at time of analysis. Upstream fix availability per vendor advisory is confirmed, but the exact release version is not. As a compensating control before patching, restrict access to the audit log details view to the minimum set of trusted administrators - reducing the population of potential victims limits the blast radius. Additionally, audit existing usernames in the database for suspicious content such as script tags or JavaScript event-handler strings and remove or sanitize any found, which will neutralize already-stored payloads before they can be triggered.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Session fixation via failed authentication in Revive Adserver 6.0.7's XML-RPC API allows a low-privileged attacker to by
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today