What is the CVSS score of EUVD-2026-39604?

EUVD-2026-39604 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Revive Adserver EUVD-2026-39604

| CVE-2026-50740 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 hackerone

GHSA-w359-3g2m-wx65

PHP XSS Adserver Revive

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (hackerone) PRIMARY

MEDIUM

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L chosen over provided PR:N because the description specifies a low-privileged actor as the exploiting party, overriding the input vector's inconsistency.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 20:37 NVD

6.1 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Jun 26, 2026 - 01:46 vuln.today

DescriptionNVD

A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.

AnalysisAI

Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the refresh parameter in the zone-include.php iFrame invocation script. The CVSS scope change (S:C) indicates that attacker-controlled script executes in the victim's browser security context, enabling session hijacking, credential theft, or malicious redirects against targeted users who click a crafted URL. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis, though the low attack complexity makes this straightforward for any attacker with XSS capability.

Technical ContextAI

Revive Adserver is a PHP-based open-source ad serving platform. The vulnerability resides in zone-include.php, the script responsible for generating iFrame-based ad zone invocation tags. CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS) identifies the root cause as failure to sanitize or encode the refresh parameter before embedding it into the HTTP response body. Because the output is reflected directly into the page without escaping, attacker-supplied script content is executed by the victim's browser. The CPE string cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:* covers all Revive Adserver versions up to and including 6.0.7.

RemediationAI

No vendor-released patch or fixed version number has been identified in the available data at time of analysis. The HackerOne report at https://hackerone.com/reports/3780806 should be monitored for an official patch release from the Revive Adserver maintainers. Until a patch is available, operators should apply output encoding to the refresh parameter in zone-include.php to neutralize reflected content. Deploying a Content Security Policy (CSP) header with a restrictive script-src directive will significantly reduce the impact of any successful XSS injection by blocking inline script execution in the victim's browser. Additionally, restricting access to zone-include.php via IP allowlist or enforcing authentication on that endpoint - accepting the trade-off of reduced ad-tag accessibility - would eliminate the attack surface entirely. A WAF rule filtering common XSS payloads in the refresh query parameter offers a lower-friction compensating control with the caveat that WAF bypass techniques exist.