EUVD-2026-38500
GHSA-h4mp-fxvg-qvvr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privileged Revive account
-
DeliveryReach delivery-limitations save endpoint
-
ExploitSubmit unexpected component parameter with PHP payload
-
InstallPayload stored in compiledlimitations
-
C2Banner request triggers delivery evaluation
-
ExecutePHP executes as web process
-
ImpactPivot or persist on ad server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on the Revive Adserver web UI at the low-privilege tier (advertiser/agency) sufficient to reach the save-delivery-limitations action, network reachability to that admin endpoint, and a target instance running Revive Adserver 6.0.6 or earlier where the compiledlimitations field is evaluated at banner delivery time. Triggering the planted PHP additionally requires that at least one banner using the poisoned limitation be requested via the ad-delivery URL, so instances where the attacker-controlled campaign is paused or never trafficked will not fire the payload. No user interaction by an administrator is needed (UI:N), but pre-auth, unauthenticated exploitation is not possible because PR:L is required. |
| Impact | The CVSS 3.0 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a realistic post-authentication remote RCE: network-reachable admin UI, low complexity, only a low-privileged Revive account required, no user interaction, and full CIA impact on the host process. PR:L meaningfully narrows the population versus a pre-auth bug, but Revive deployments commonly provision advertiser/agency accounts, so the authentication barrier is lower in practice than for an admin-only flaw. No EPSS, KEV, or SSVC signals were provided in the input, and no public exploit identified at time of analysis; the only reference is the HackerOne report, so widespread opportunistic exploitation is unlikely today but the bug is well-suited to targeted abuse once details are public. Real priority for any internet-exposed Revive instance, especially multi-tenant ones where untrusted advertisers hold accounts; lower urgency for single-tenant intranet deployments. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privileged advertiser account on an internet-exposed Revive instance, opens the delivery limitations editor for one of their banners, and submits a crafted request that includes an unexpected component parameter whose value carries PHP syntax. The injected fragment is written verbatim into compiledlimitations, and the next time the banner is requested by any visitor the delivery engine evaluates the row and runs the attacker's code as the web process. No public exploit identified at time of analysis, but the attack pattern is straightforward to reproduce from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpected parameter into the delivery limitations save flow, planting attacker-controlled PHP into the compiledlimitations field that is then evaluated when banners are served. With CVSS 8.8 and a CWE-94 root cause, successful exploitation yields full code execution under the web/ad-delivery process, though there is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV.
RemediationAI
Upgrade to the Revive Adserver release that follows 6.0.6 and contains the improved input sanitisation that filters unexpected parameters out of the delivery-limitations save path; the input notes the fix conceptually but does not supply an exact patched version number, so confirm the target release against the vendor download page and the HackerOne report at https://hackerone.com/reports/3744200 before deploying. Until patched, restrict who can create or edit banner delivery limitations by limiting low-privileged advertiser/agency account provisioning, place the Revive admin UI behind VPN or IP allow-listing so untrusted users cannot reach the save endpoint, and audit the compiledlimitations column for suspicious PHP fragments before re-enabling delivery; each of these reduces attack surface at the cost of administrative overhead and, for IP allow-listing, blocking legitimate remote advertiser self-service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Revive Adserver is an open-source PHP ad-serving platform descended from OpenX. Delivery limitations are persisted as a precompiled PHP expression in the compiledlimitations column, which the delivery engine evaluates at banner-serving time to decide whether a creative is shown. The flaw, classified as CWE-94 (Improper Control of Generation of Code), stems from accepting an unexpected component parameter during the save-limitations action and weaving its value into that compiled PHP without filtering, so attacker-controlled syntax becomes part of the code the delivery layer runs. The affected component is identified by CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*, covering all Revive Adserver versions up to and including 6.0.6.
Know when Adserver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin UI, low complexity, requires a low-privileged Revive account (PR:L), no user interaction, and stored PHP execution yields full host-process CIA impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery. Input sanitisation has been improved to ensure that unexpected parameters are filtered out.
Articles & Coverage 2
Executive ViewAI
Revive Adserver versions 6.0.6 and earlier contain an authenticated code injection vulnerability that allows low-privilege users to execute arbitrary PHP code through the ad-delivery infrastructure. Organizations running affected versions face potential compromise of their advertising systems and downstream services, with no vendor-released patch currently available. This risk is elevated for companies with broad internal access to ad-server administration.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict access to delivery-limitation configuration to essential administrators only; (2) Implement network segmentation isolating ad-server from sensitive backend systems; (3) Deploy WAF rules to detect unusual parameter injection patterns in ad-server requests; (4) Enable comprehensive audit logging for all configuration changes and PHP execution events; (5) Monitor web/ad-delivery process activity for anomalous code execution patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Improper access control in Revive Adserver 6.0.6 and earlier allows an authenticated low-privileged user to link their o
Missing access control on XML-RPC API modify methods in Revive Adserver 6.0.6 and earlier permits authenticated low-priv
Exploit-DB