CVE-2026-21642

MEDIUM

Revive Adserver < 6.0.4 - Reflected Cross-Site Scripting via banner-acl.php and channel-acl.php

Title source: llm

Description

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

References (1)

Core 1

Core References

Third Party Advisory

https://hackerone.com/reports/3470970

Scores

CVSS v3 6.1

EPSS 0.0016

EPSS Percentile 5.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

aquaplatform/revive_adserver < 6.0.4

Published Jan 20, 2026

Tracked Since Feb 18, 2026