CVE-2026-21664

MEDIUM

Revive Adserver 6.0.0-6.0.3 - Reflected Cross-Site Scripting via afr.php Parameter

Title source: llm

Description

HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

References (1)

Core 1

Core References

Third Party Advisory

https://hackerone.com/reports/3468169

Scores

CVSS v3 6.1

EPSS 0.0016

EPSS Percentile 5.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

aquaplatform/revive_adserver 6.0.0 - 6.0.4

Published Jan 20, 2026

Tracked Since Feb 18, 2026