Revive Adserver vulnerabilities

A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low-privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery.

The vulnerability allows advertiser-level users to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions.

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low-privileged user to inject malicious PHP code into the compiledlimitations field on the database, resulting in its execution during banner delivery.

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts to identify and fix other potential CSRF vulnerabilities.

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). Several scripts in Revive Adserver's user interface are vulnerable to these attacks.

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF) in the password recovery form. This vulnerability could be exploited to send a large number of password recovery emails to registered users.

Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.

The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before version 3.2.2 does not restrict access from other domains, allowing remote attackers to conduct cross-domain attacks via unspecified vectors.

Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been deleted or unlinked.

Revive Adserver versions before 3.2.5 and 4.0.0 are vulnerable to Reflected File Download (RFD) attacks. Attackers can exploit the vulnerability in `www/delivery/asyncspc.php` to remotely download a file onto the victim's machine.

Revive Adserver before 3.2.3 suffers from session fixation, allowing arbitrary session identifiers to be forced. Additionally, it does not invalidate the existing session upon successful authentication, which could enable an attacker to steal an authenticated session.

Revive Adserver before version 3.2.3 suffers from improper restriction of excessive authentication attempts. The login page is vulnerable to password-guessing attacks, which may lead to unauthorized access.

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.

Revive Adserver 6.0.7 contains a CSRF vulnerability in the `zone-include.php` script. Linking and unlinking banners or campaigns to zones can be triggered via crafted GET or POST requests without CSRF token verification, allowing an attacker to perform these actions on behalf of an authenticated administrator.

A bypass to the admin-only restriction of the XML-RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated, allowing the leaked session ID to be used for subsequent unrestricted API calls.

A stored XSS vulnerability exists in the maintenance-acl-check.php and maintenance-banners-check.php tools of Revive Adserver 6.0.7. Entity names are displayed without proper escaping when inconsistencies are detected.

In Revive Adserver 6.0.7 and earlier, missing sanitization of user input in the zone-include.php script allows XSS attacks. A low-privileged user can exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.

A bypass for CVE-2026-34913 exists in Revive Adserver 6.0.7 and earlier due to missing ownership validation in the reverse operation of linking campaigns and trackers via the `tracker-campaigns.php` script. A low-privileged user can link their trackers to campaigns owned by other managers on the same instance, causing inconsistent ownership relationships.

Revive Adserver 6.0.0+ has improper input neutralization, allowing a reflected XSS attack in the banner-zone.php script.

Revive Adserver 5.5.2 and 6.0.1 and earlier versions have improper input neutralization, allowing manager accounts to craft XSS attacks against their own advertiser users.

Debug information disclosure in the SQL error message in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts.

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions cause non-admin users to have access to the contact name and email address of other users on the system.

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

Improper Neutralization of Input in Revive Adserver 5.5.2, 6.0.1 and earlier versions causes a potential reflected XSS attack. The vulnerability allows injection of malicious JavaScript that is reflected back to the victim's browser.

An authorization bypass in Revive Adserver 5.5.2, 6.0.1 and earlier versions allows a logged-in attacker to change other users' email addresses and potentially take over their accounts using the forgot password functionality. The vulnerability involves improper access control.

SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the Revive Adserver UI into clicking a crafted URL and execute injected JavaScript in the victim's browser context. The vulnerability is present in admin-search.php and can be exploited via the compact parameter.