CVE-2026-21663

MEDIUM

Revive Adserver 6.0.0-6.0.3 - Reflected Cross-Site Scripting in banner-acl.php

Title source: llm

Description

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

References (1)

Core 1

Core References

Third Party Advisory

https://hackerone.com/reports/3473696

Scores

CVSS v3 6.1

EPSS 0.0016

EPSS Percentile 5.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

aquaplatform/revive_adserver 6.0.0 - 6.0.4

Published Jan 20, 2026

Tracked Since Feb 18, 2026