CVE-2025-52671
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Debug information disclosure in the SQL error message in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.
Risk Assessment
Disclosure of software, PHP, and database versions helps an attacker select exploits matching known vulnerabilities. This may lead to further attack escalation.
Recommendation
Update Revive Adserver to a version later than 5.5.2/6.0.1, disable detailed SQL error messages in production, and restrict access to debug information.
Other vulnerabilities in Revive Adserver
See all- CVE-2026-44959High
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low-privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery.
- CVE-2026-44958Medium
The vulnerability allows advertiser-level users to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions.
- CVE-2026-34916High
A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low-privileged user to inject malicious PHP code into the compiledlimitations field on the database, resulting in its execution during banner delivery.
- CVE-2016-9456High
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts to identify and fix other potential CSRF vulnerabilities.
- CVE-2016-9455High
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). Several scripts in Revive Adserver's user interface are vulnerable to these attacks.
- CVE-2016-9127High
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF) in the password recovery form. This vulnerability could be exploited to send a large number of password recovery emails to registered users.
- CVE-2015-7372High
Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.
- CVE-2015-7369High
The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before version 3.2.2 does not restrict access from other domains, allowing remote attackers to conduct cross-domain attacks via unspecified vectors.
- CVE-2015-7367High
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been deleted or unlinked.
- CVE-2016-9470Critical
Revive Adserver versions before 3.2.5 and 4.0.0 are vulnerable to Reflected File Download (RFD) attacks. Attackers can exploit the vulnerability in `www/delivery/asyncspc.php` to remotely download a file onto the victim's machine.
Original NVD description (English source)
Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS