What is the CVSS score of CVE-2026-50745?

CVE-2026-50745 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Revive Adserver CVE-2026-50745

EUVD-2026-39605 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 hackerone

GHSA-8xrw-qpv5-m4qm

PHP XSS Adserver Revive

6.1

CVSS 3.1 · NVD

Severity by source

Vendor (hackerone) PRIMARY

MEDIUM

qualitative

NVD

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Reflected XSS via crafted URL requires no auth and is low complexity once the parameter is known; scope changes to victim browser; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 20:22 NVD

4.7 (MEDIUM) 6.1 (MEDIUM)

Analysis Generated

Jun 26, 2026 - 01:46 vuln.today

DescriptionNVD

A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.

AnalysisAI

Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary JavaScript into victim browsers by delivering a crafted URL. The Smarty template engine's custom url helper function emits attacker-controlled values without HTML encoding or sanitization, and the URL construction pattern for this endpoint exposes user input directly in rendered output. No active exploitation has been confirmed (not in CISA KEV), but the vulnerability is reachable without authentication and requires only victim interaction with a malicious link.

Technical ContextAI

Revive Adserver is a PHP-based open-source ad serving platform that uses the Smarty templating engine. The affected component is stats-video.php, which relies on a custom Smarty helper function named url to construct output URLs. CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS) identifies the root cause: user-supplied values passed through this helper are reflected directly into the HTTP response without context-aware HTML encoding. CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:* covers all versions of the adserver product, indicating no version range has been explicitly bounded in NVD data. The vulnerability class is classic reflected (Type 1) XSS - no persistence on the server is required; the payload travels in the request and is echoed back in the response.

RemediationAI

The primary fix is to apply output encoding to all values emitted by the Smarty url custom helper function in stats-video.php, and to audit other Smarty helper outputs for the same pattern. Refer to the vendor disclosure at https://hackerone.com/reports/3793243 for the precise patch or commit. No specific patched release version was confirmed in the available input data - monitor the Revive Adserver project for an official release addressing this report. As a compensating control prior to patching, operators can implement a Content Security Policy (CSP) header that restricts inline script execution (script-src 'self'), which will block most reflected XSS payloads from executing even if the parameter remains unsanitized; note that overly broad CSP policies may break legitimate adserver functionality and require testing. Web application firewall rules targeting XSS signatures on the stats-video.php endpoint can also reduce exposure, though WAF bypass is always possible for a determined attacker.