Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Revive Adserver Vulnerabilities",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matteo Beccati"
}
],
"descriptions": [
{
"lang": "en",
"value": "========================================================================\nRevive Adserver Security Advisory REVIVE-SA-2026-003\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-003\n------------------------------------------------------------------------\nDate: 2026-06-25\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: <= 6.0.7\nVersions not affected: >= 6.0.8\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-50739\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780709\nhttps://github.com/revive-adserver/revive-adserver/commit/c03a0b6d\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Reflected XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-50740\nRisk level: Medium\nCVSS Base Score: 6.1\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780806\nhttps://github.com/revive-adserver/revive-adserver/commit/03d9ad8b\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n3. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-50741\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780854\nhttps://hackerone.com/reports/3781492\nhttps://github.com/revive-adserver/revive-adserver/commit/3d1485de\nhttps://github.com/revive-adserver/revive-adserver/commit/becaf6e7\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n4. Stored XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-50742\nRisk level: Medium\nCVSS Base Score: 4.4\nCVSS Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781311\nhttps://github.com/revive-adserver/revive-adserver/commit/91abb6ab\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Cross-Site Request Forgery\n========================================================================\nVulnerability Type: CWE-352: Cross-Site Request Forgery\nCVE-ID: CVE-2026-50743\nRisk level: Medium\nCVSS Base Score: 5.4\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781691\nhttps://github.com/revive-adserver/revive-adserver/commit/e3c84d6f\nhttps://cwe.mitre.org/data/definitions/352.html\n\n\n========================================================================\n6. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-50744\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3783738\nhttps://github.com/revive-adserver/revive-adserver/commit/3e04cb4a\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n7. Reflected XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-50745\nRisk level: Medium\nCVSS Base Score: 4.7\nCVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3793243\nhttps://github.com/revive-adserver/revive-adserver/commit/a570a0c1\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n<security AT revive-adserver DOT com>.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-352",
"description": "CWE-352",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-79",
"description": "CWE-79",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-94",
"description": "CWE-94",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:22Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/19"
},
{
"url": "https://cwe.mitre.org/data/definitions/284.html"
},
{
"url": "https://cwe.mitre.org/data/definitions/352.html"
},
{
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"url": "https://cwe.mitre.org/data/definitions/94.html"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/03d9ad8b"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/3d1485de"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/3e04cb4a"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/91abb6ab"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/a570a0c1"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/becaf6e7"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/c03a0b6d"
},
{
"url": "https://github.com/revive-adserver/revive-adserver/commit/e3c84d6f"
},
{
"url": "https://hackerone.com/reports/3780709"
},
{
"url": "https://hackerone.com/reports/3780806"
},
{
"url": "https://hackerone.com/reports/3780854"
},
{
"url": "https://hackerone.com/reports/3781311"
},
{
"url": "https://hackerone.com/reports/3781492"
},
{
"url": "https://hackerone.com/reports/3781691"
},
{
"url": "https://hackerone.com/reports/3783738"
},
{
"url": "https://hackerone.com/reports/3793243"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.revive-adserver.com/"
},
{
"url": "https://www.revive-adserver.com/security/"
},
{
"url": "https://www.revive-adserver.com/security/revive-sa-2026-003"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/19"
],
"discovery": "EXTERNAL"
},
"title": "[REVIVE-SA-2026-003] Revive Adserver Vulnerabilities",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0144",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19",
"automated": true,
"contentSha256": "c5bcb5ce1b70d5aea4ade5341e47213742f349f29dea887b1d4dc890d0f3bbce",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/19",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-07T07:20:11Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:22Z",
"dateUpdated": "2026-09-07T13:20:22Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0144"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}