EUVD-2026-39603
GHSA-q7h4-cw8q-5rmq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by requirement for authenticated low-privilege access; AC:H reflects attacker's incomplete control over payload trigger; S:C applies as XSS crosses into admin session context.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A stored XSS vulnerabilities exists in the maintenance-acl-check.php and maintenance-banners-check.php tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.
AnalysisAI
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent XSS payloads via entity names that render unescaped within the maintenance-acl-check.php and maintenance-banners-check.php tools. When an administrator later runs these maintenance utilities and inconsistencies are detected, the malicious payload executes in the admin's browser context, potentially enabling session hijacking or unauthorized administrative actions. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the AC:H vector reflects that payload execution is partially outside attacker control, contingent on admin use of the specific maintenance tools.
Technical ContextAI
Revive Adserver is a PHP-based open-source ad serving platform (cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*), a successor to OpenX Source. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to HTML-encode entity names before rendering them in the maintenance tool output. The stored nature of the XSS means the payload persists server-side and is not immediately triggered on injection - it fires only when the affected maintenance scripts encounter and display the tainted entity names during an inconsistency-detection pass. The S:C (Scope Changed) metric in the CVSS vector is significant: the attacker's injected content executes in the higher-privileged administrator browser session, crossing a trust boundary from the attacker's own session into the admin's.
RemediationAI
No specific patched version is confirmed in the available data - the single reference points to a HackerOne report (https://hackerone.com/reports/3781311), and no vendor advisory with an explicit fix version was provided. Administrators running Revive Adserver 6.0.7 should monitor the official Revive Adserver release channel and the HackerOne disclosure for a patched release. As an interim compensating control, access to the maintenance-acl-check.php and maintenance-banners-check.php scripts should be restricted to trusted network segments or localhost only, preventing low-privilege web-authenticated attackers from injecting data processed by these tools. Additionally, reviewing and sanitizing existing entity names for embedded HTML or JavaScript content can remove persisted payloads. Note that restricting network access to maintenance scripts may limit remote administration workflows.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today