HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/3445332 | Third Party Advisory |
Configurations
History
30 Jan 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Aquaplatform
Aquaplatform revive Adserver |
|
| References | () https://hackerone.com/reports/3445332 - Third Party Advisory | |
| CPE | cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:* |
21 Jan 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-134 |
20 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 21:16
Updated : 2026-01-30 20:17
NVD link : CVE-2026-21640
Mitre link : CVE-2026-21640
CVE.ORG link : CVE-2026-21640
JSON object : View
Products Affected
aquaplatform
- revive_adserver
CWE
CWE-134
Use of Externally-Controlled Format String