Filtered by vendor Revive Subscriptions

Search

Switch to Advanced Search (Beta)
Total 19 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-55123 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-05 5.4 Medium
Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.
CVE-2025-52666 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-02 N/A
Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.
CVE-2025-52667 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-02 5.4 Medium
Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.
CVE-2025-52668 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-02 5.4 Medium
Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.
CVE-2025-52669 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-02 N/A
Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.
CVE-2025-52670 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-02 6.5 Medium
Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts
CVE-2025-52671 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-02 N/A
Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.
CVE-2025-55129 1 Revive 1 Adserver 2025-12-02 N/A
HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne users, such as itz_hari_ and khoof.
CVE-2025-55128 1 Revive 1 Adserver 2025-12-02 N/A
HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with access to the admin interface could request an arbitrarily large number of items per page, potentially leading to a denial of service.
CVE-2025-55126 1 Revive 1 Adserver 2025-12-01 N/A
HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages, with campaign names being the vector for the stored XSS
CVE-2025-52664 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-01 8.8 High
SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users
CVE-2025-27208 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-01 6.1 Medium
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed. The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.
CVE-2025-55124 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-11-26 N/A
Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.
CVE-2025-48986 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-11-25 N/A
Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.
CVE-2025-48987 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-11-25 6.1 Medium
Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.
CVE-2025-55127 1 Revive 1 Adserver 2025-11-24 5.4 Medium
HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.
CVE-2025-62954 2 Revive, Wordpress 2 Revive Old Posts, Wordpress 2025-11-13 8.8 High
Missing Authorization vulnerability in Codeinwp Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive Old Posts: from n/a through <= 9.3.3.
CVE-2022-4680 1 Revive 1 Revive Old Posts 2025-03-27 7.2 High
The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
CVE-2023-26756 1 Revive 1 Adserver 2024-11-21 7.5 High
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features.